How do I timechart two different data points on the same chart?

[dhilipvenkatesh]

I have a use case where I want to chart system utilization vs incoming requests. This is really helpful in data correlation. Let's say I have the incoming requests in index=requests and system utilization maintained in index=nmon. I need to timechart both of these data points in the same chart where utilization needs to be a line chart and requests will be a bar graph.

Can you please suggest how I can accomplish this use case?

[renjith_nair]

@dhilipvenkatesh ,

You may try using overlay

(index=requests OR index=nmon)|timechart avg(requests) as requests,avg(utilization) as utilization

Select visualization as column chart and in the format - > Chart Overlay select utilization in overlay

Reference : https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchTutorial/Chartoverlays