Splunk Search

How do I timechart two different data points on the same chart?

dhilipvenkatesh
New Member

I have a use case where I want to chart system utilization vs incoming requests. This is really helpful in data correlation. Let's say I have the incoming requests in index=requests and system utilization maintained in index=nmon. I need to timechart both of these data points in the same chart where utilization needs to be a line chart and requests will be a bar graph.

Can you please suggest how I can accomplish this use case?

0 Karma

renjith_nair
Legend

@dhilipvenkatesh ,

You may try using overlay

(index=requests OR index=nmon)|timechart avg(requests) as requests,avg(utilization) as utilization

Select visualization as column chart and in the format - > Chart Overlay select utilization in overlay

Reference : https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchTutorial/Chartoverlays

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...