Splunk Search

How to combine two searches in one timechart and show dynamic x-axis labels?

rajinovat
New Member

Hi All,
I would like to combine below two searches in one timechart stacked with x axis showing date and total records under each column stack
Search 1: ( Display batch runtime(in hours) by batch code over a day)
index=batch batch_cd="A1" OR batch_cd="A2" OR batch_cd="A3" OR batch_cd="A4" | timechart span=1d eval(sum(total_time)/60) as hours by batch_cd usenull=f useother=f limit=0
Search 2: ( Display total records processed by batch code over a day)
index=batch batch_cd="B1" OR batch_cd="B2" | bucket _time span=1d | stats sum(total_records) as tot_rec by batch_cd

1.Combine above two searches in a single query
2.Display search results in stacked mode
3.Display total_records below x axis along with time chart date
4.Show runtime hours as running labels top of each stack bar
5.Show legends grouped logically

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can do that... if you build yourself the appropriate visualization, e.g. using D3. The customizability of charts, either built-in or provided by 3rd party apps, does not go as far as you describe.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...