Splunk Search

how to combine time chart and bar chart together

cheriemilk
Path Finder

Hi team,

1. I have first query which return me below chart

 

 

 

 

<baseQuery>
|timechart span=4w count(ACT) as countOfOpenSession, 
                   distinct_count(UID) as countOfUserID, 
                   distinct_count(CMN) as countOfCustomer

 

 

 

 

cheriemilk_0-1634713532480.png

 

 

2. then I have second query which return me below table and chart, which is for getting the CMN value which has highest hit value per month.

 

 

 

 

<baseQuery>
| stats count(ACT) as hit by date_month CMN
| eventstats max(hit) as maxhit by date_month
| where hit=maxhit
| fields - maxhit

 

 

 

 

 

cheriemilk_2-1634713812240.png

 

 

cheriemilk_1-1634713662087.png

 

 

Expected Chart I want to get from splunk search:

1. combine the two queries into one. (by the way, baseQuery for the two queries in my scenario are  same.)

2. combine the timeline chart and bar chart into one chart . 

3. From the combined chart->on the bars, to display both CMN(customer Name) and hit count

 

Here is an example chart I want(similar to below)

cheriemilk_3-1634714193515.png

 

 

how to edit the query and format to achieve the expected chart?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...