Hi Dear Splunkers,
I have three searches that display the output into a Dashboard in three different panel, but I want to combine them into one linear chart, thank you.
(index=ONE)
(sourcetype="ONE")
(ID1="*")
| eval ID1 = lower(ID1)
| timechart span=1d distinct_count(ID1)
(index=TWO)
(sourcetype="TWO")
(ID2="*")
| eval ID2 = lower(ID2)
| timechart span=1d distinct_count(ID2)
(index=THREE)
(sourcetype="THREE")
(ID3="*")
| eval ID3 = lower(ID3)
| timechart span=1d distinct_count(ID3)
What do you mean by "combine"? These searches will give you three data points for a single day. You want tom have them graphed separately as different timeseries in a common chart? Or do you want to sum them into a single value? Or maybe you want a max value of those three? Or anything else?