@josephinemho what do you mean by two separate time span. Does it imply that they have same time filter but only spans are different i.e. 5 min and default span based on time selected? Or are they running for two different time period and also with two different span?
What is the time selected for both searches? For us to assist you better with your requirement kindly provide more details.
Before we suggested you solution for your problem, two try out following couple of query optimization tips:
1) Add search filter to base search rather than second pipe (With search optimization enabled by default Splunk should correct this for your however, it is better if you wrote the better query upfront).
Hi @niketnilay, I'd like to have the same time filter and search query, but only the time spans are different. The time selected for both searches will change depending on the filter selected.
Also, I used values() because I'm looking at CPU data, and oftentimes CPU jumps from low to high within a time span, so I wanted to capture it all. That's why one of the chart is using the average and the other is using all its values. I wanted to overlay them so we can easily see all the CPU activity of a server, but also use the average line chart to see any overall trends.
Hi @gpradeepkumarreddy I believe chart overlay doesn't work if the charts are using different time spans (at least I have not gotten it to work with different spans).