Splunk Search

how to combine time chart and bar chart together

Path Finder

Hi team,

1. I have first query which return me below chart





|timechart span=4w count(ACT) as countOfOpenSession, 
                   distinct_count(UID) as countOfUserID, 
                   distinct_count(CMN) as countOfCustomer








2. then I have second query which return me below table and chart, which is for getting the CMN value which has highest hit value per month.





| stats count(ACT) as hit by date_month CMN
| eventstats max(hit) as maxhit by date_month
| where hit=maxhit
| fields - maxhit












Expected Chart I want to get from splunk search:

1. combine the two queries into one. (by the way, baseQuery for the two queries in my scenario are  same.)

2. combine the timeline chart and bar chart into one chart . 

3. From the combined chart->on the bars, to display both CMN(customer Name) and hit count


Here is an example chart I want(similar to below)




how to edit the query and format to achieve the expected chart?

Labels (2)
0 Karma