Splunk Search

How do I timechart two different data points on the same chart?

dhilipvenkatesh
New Member

I have a use case where I want to chart system utilization vs incoming requests. This is really helpful in data correlation. Let's say I have the incoming requests in index=requests and system utilization maintained in index=nmon. I need to timechart both of these data points in the same chart where utilization needs to be a line chart and requests will be a bar graph.

Can you please suggest how I can accomplish this use case?

0 Karma

renjith_nair
Legend

@dhilipvenkatesh ,

You may try using overlay

(index=requests OR index=nmon)|timechart avg(requests) as requests,avg(utilization) as utilization

Select visualization as column chart and in the format - > Chart Overlay select utilization in overlay

Reference : https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchTutorial/Chartoverlays

---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...