Splunk Search

How to combine my timechart searches to generate a line graph in a single panel?

sravankaripe
Communicator

i have a use case to combine three line graph into one panel. and i have searches like this

1) index=abc -------------| timechart avg(val1)
2) index=abc -------------| timechart avg(val2)
3) index=abc -------------| timechart avg(val3)

Please let me know how can i combine this three searches in order to see this three line graph in one single panel.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi sravankaripe,
you should build something like this:

index=abc | bin =1h | timechart avg(val1) AS val1
| append [ index=abc | bin =1h | timechart avg(val2) AS val2 ]
| append [ index=abc | bin =1h | timechart avg(val3) AS val3 ]
| stats values(val1) AS val1 values(val2) AS val2 values(val3) AS val3 by _time

Bye.
Giuseppe

View solution in original post

0 Karma

somesoni2
Revered Legend

Best option would be to merge the base searches on the those 3 searches. 2nd best option would to use append/appendcols command to merge those results. Which one is feasible can be decided if you could post your full searches.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi sravankaripe,
you should build something like this:

index=abc | bin =1h | timechart avg(val1) AS val1
| append [ index=abc | bin =1h | timechart avg(val2) AS val2 ]
| append [ index=abc | bin =1h | timechart avg(val3) AS val3 ]
| stats values(val1) AS val1 values(val2) AS val2 values(val3) AS val3 by _time

Bye.
Giuseppe

0 Karma

sravankaripe
Communicator

i got it by appendcols

0 Karma

hortonew
Builder

You can use the append/appendcols command(s). For instance:

index=abc | timechart avg(val1) | append [index=abc | timechart avg(val2)] | append [index=abc | timechart avg(val3)]

or the following if it really is the same data you're pulling values from

index=abc | timechart avg(val1) avg(val2) avg(val3)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...