Splunk Search
Highlighted

How to join normalized data into a single timechart?

New Member

We have normalized data where multiple rows represent a single point in time, but attributes within the row represent the type. For example:

time=1 metric=ReadIOPs Average=0.01
time=1 metric=WriteIOPs Average=0.02

And so forth. There are multiple metric types beyond what is shown here. We would like to have this appear in a single timechart overlayed. We can get it to work in separate time charts by simply doing:

metric_name=ReadIOPs | timechart values(Average) as ReadIOPs

Is it possible to get this to join both Read and Write together into a single timechart?

0 Karma
Highlighted

Re: How to join normalized data into a single timechart?

Legend

Try this

 metric_name=* | chart values(Average) as IOPs over _time by metric_name

View solution in original post