Splunk Search

Splunk query to merge 2 timecharts as overlay



I have 2 timecharts that are working independently, can you help to merge both to one query (as overylay), the modified query should show timecharts based on 2 different source types and different criteria's.

Query 1 : index=index1 sourcetype="sourcetype1" "SearchString1"|timechart count span=1h
Query 2 : index=index1 sourcetype=sourcetype2 "SearchString2"=* | timechart count by "SearchString2"

Tags (1)
0 Karma


Hi somesoni2,

thanks for your input, I tried and it seems its not considering SearchString1 values, could you help me understand in detail as i could try/tweak it.

Mathan J

0 Karma


Give this a try

index=index1 (sourcetype="sourcetype1" "SearchString1") OR (sourcetype=sourcetype2 "SearchString2"=*)
| eval "SearchString2"=if(sourcetype="sourcetype1","count",'SearchString2')
| timechart count by "SearchString2"
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...