Splunk Search

Two intention searches on one timechart

lain179
Communicator

Hi,

I have two separate searches that I would like to put together one graph. I don't think I can use a join because they are both intention searches. I think I can't use chart overlay either.

The usage is that the user will choose a server from a drop down list, which will trigger those two searches separately. One search creates an area timechart and the second one creates a splitSeries line timechart. Now I have them on two separate chart but I would like to put them on one time chart if possible.

Appreciate any help.

Thanks.

Tags (2)
0 Karma

jonuwz
Influencer

Its possible but not easy.

You're going to need to come up with a search that mashes all the data into a a single result

i.e.

_time  area_value  split_value1 split_value2 split_value3

Then play with multi axis graphs.
Example here - the color stuff can be ignored - I needed that or something else.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...