Hi team,
1. I have first query which return me below chart
<baseQuery>
|timechart span=4w count(ACT) as countOfOpenSession,
distinct_count(UID) as countOfUserID,
distinct_count(CMN) as countOfCustomer
2. then I have second query which return me below table and chart, which is for getting the CMN value which has highest hit value per month.
<baseQuery>
| stats count(ACT) as hit by date_month CMN
| eventstats max(hit) as maxhit by date_month
| where hit=maxhit
| fields - maxhit
Expected Chart I want to get from splunk search:
1. combine the two queries into one. (by the way, baseQuery for the two queries in my scenario are same.)
2. combine the timeline chart and bar chart into one chart .
3. From the combined chart->on the bars, to display both CMN(customer Name) and hit count
Here is an example chart I want(similar to below)
how to edit the query and format to achieve the expected chart?