How to display multiple field averages overtime?

[SecDesh]

Good Morning,

I am attempting to use visualization that will display the averages of 2 specific fields (bytes_in and bytes_out) in the same chart, overtime. I've attempted to do research through various older posts however most of them involving combining multiple fields into 1 average which is something I do not want to do. Others had suggestions that were similar to what I was asking but didn't display it overtime, rather it just displayed data on the day.

An extremely helpful bonus if you guys are also able to provide help/solution on how to display multiple time instances as well in the chart (24H, 7D, 30D) rather than having to create 3 panels.

[yuanliu · Accepted solution]

It would help if you can provide some sort of mockup to clarify the ask.  "| timechart avg(bytes_in) avg(bytes_out)" does show two plots in one chart.  Is that enough?

As to displaying different time windows, what is the envisioned layout?  Three lines each representing a different time scale on the same time-axis? (In other words, the same length on the time-axis will represent three different time periods.)  In all cases, to produce three variables to represent averages on three time scales in SPL will likely be more expensive than running three panels. (One way to do this is to use append to combine different searches.)

[SecDesh]

Your first answer is perfect and I don't know how I was unable to get to this solution. I attempted to solve the problem initially by doing:

Base Search
| timechart avg(bytes_in) AND avg(bytes_out)

However this would give me errors in the timechart command. I am new to Splunk and I figured I needed the specifier to explicitly state, "Include this field AND this field in the timechart".

As for the second, I've ran into a post that displays it all on the time axis (kinda?), but it would only be registered to whatever day the bucket was set to. It's no big deal, I don't mind the 3 panels. I just thought there would be a more efficient way. Thank you again.