Splunk Search

How do I put a line graph that shows data in both indexes into one graph?

Path Finder

Hi,

I want to get a line graph with two indexes of data.

My command is index=interface sourcetype="in_t"| timechart count and index=imp sourcetype="out_t"| timechart count

What should I do?

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

@WXY,

Try

(index=interface OR index=imp) (sourcetype="in_t" OR sourcetype="out_t")|timechart count by sourcetype

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi WXY
try

(index=interface sourcetype="in_t") OR (index=imp sourcetype="out_t")
| timechart count

Bye.
Giuseppe

0 Karma

SplunkTrust
SplunkTrust

@WXY,

Try

(index=interface OR index=imp) (sourcetype="in_t" OR sourcetype="out_t")|timechart count by sourcetype

View solution in original post

0 Karma