Splunk Search

## Need to Create Two Time Series in One Chart

Splunk Employee

Tags (3)
Splunk Employee

Credit to Dritan.

Plotting two time-series in one chart is a frequent ask from many of our customers. After several related questions/requests in chat and mailing lists I decided to create and share three macros to facilitate this. They draw two time-series graphs by using a single search while manipulating the _time field and then keying the series off of a new field. Of course, there are several ways to achieve this, as witnessed in Answers and elsewhere, so feel free to modify as necessary. But whatever smart changes and improvements you make (such as parametrize even further ex. the time range, the span etc), please share.

# hour over hour compare, 1m span

[twoseries_h(2)]
args = search, measure
definition = \$search\$ earliest=-1h@h \
| bin span=1m _time\
| eval marker = if(_time < info_min_time + 3600, "Last Hour", "Current Hour") \
| eval _time = if(_time < info_min_time + 3600, _time + 3600, _time) \
| chart \$measure\$ by _time marker
iseval = 0

# day over day compare, 15m span

[twoseries_d(2)]
args = search, measure
definition = \$search\$ earliest=-1d@d \
| bin span=15m _time\
| eval marker = if(_time < info_min_time + 24*3600, "Yesterday", "Today") \
| eval _time = if(_time < info_min_time + 24*3600, _time + 24*3600, _time) \
| chart \$measure\$ by _time marker
iseval = 0

# week over week compare, 1h span

[twoseries_w(2)]
args = search, measure
definition = \$search\$ earliest=-1w@w\
| bin span=1h _time\
| eval marker = if(_time < info_min_time + 7*24*3600, "Last Week", "Current Week") \
| eval _time = if(_time < info_min_time + 7*24*3600, _time + 7*24*3600, _time) \
| chart \$measure\$ by _time marker
iseval = 0

## Sample Searches:

Event Count: Current Hour vs. Last Hour

`twoseries_h("index=_internal", count)`

Indexing Thruput: Today vs. Yesterday
`twoseries_d("index=_internal group=per_index_thruput series=_internal", "avg(kbps)")`

Started Searches: Current Week vs. Last Week
`twoseries_w("index=_internal source=*metrics.log group=searchscheduler", "sum(dispatched)")`

Get Updates on the Splunk Community!

#### .conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

#### Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

#### Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...