How to overlay two searches on the same graph?

[mark_chuman]

I have these two searches and am trying to figure out the best way to overlay them both on the same graph:

search 1

index=distributed sourcetype=vcenter_* "[Vdb::GetConnection] Failed to obtain connection" OR "SHUTDOWN is in progress." sourcetype=vcenter_vpxdlogs host=eivc2*vwin | timechart count by host

search 2

index=distributed sourcetype=vcenter_* sourcetype=vcenter_vpxdlogs "Starting VMware VirtualCenter" host=eivc2*vwin | timechart count by host

Thanks!

[MuS]

Hi mark.chuman,

take a look at this answer here http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi... this will give you an idea how this could be done.

hope this helps ...

cheers, MuS

[ChrisG]

As MuS says (definitely check out the awesome answer he links to), the search is the key. On the visualization side, there are a couple of examples in the docs: Chart overlay