How to create a single visualization using the results from multiple searches?

[splunknewby]

Currently I have four different visualizations (bar graphs) that are created using a data set. Each search I run filters for a specific set of conditions on that data, and a visualization is drawn after.

My problem is, once I generate the first graph, I would like to run a completely new search on the complete data (without using the filtered data of the last search), filter and generate my second graph and overlay this on top of the first graph.

How would I go about doing this?

I would like to overlay all four graphs on top of each other. If this isn't possible, then draw everything in a single graph without the overlaying.

The important bit is somehow storing the variables from the previous search so that I can use it at the end for a single graph.

[emiller42]

Without any specifics, I can't really give you code. But it sounds like all of your graphs are coming from the same source set of data. So see what you can do to get to your final result set in a single search.

If you're filtering the data set, see if you can use those filters to simply identify matching records and categorize them appropriately:

sourcetype=my_sourcetype 
| eval category=case(searchmatch("some conditions"), "category_one", searchmatch("different conditions"), "category_two") 
| timechart count by category

This is just a general example. You can use many methods to generate fields which can be used to construct your final output.

Attempting the above accomplishes a couple of things for you:

1. It gets your consolidated graph as you desire
2. It gets your result in a single search pass instead of running multiple searches over the same data. Generally, this is a significant performance increase.