Splunk Search

multiple search results on singlechart

ChhayaV
Communicator

hi,

these are my searches

index=tm_idx host="audit" | timechart count by Process usenull="f"

index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"

I want to show result of these searches on a single chart

1 Solution

HiroshiSatoh
Champion

I think it is good if you use the append.

index=tm_idx host="audit" | timechart count by Process usenull="f"|append [search index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"]

View solution in original post

HiroshiSatoh
Champion

I think it is good if you use the append.

index=tm_idx host="audit" | timechart count by Process usenull="f"|append [search index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"]

zeroactive
Path Finder

Using "append" will give you a two charts side by side with the timeframe repeated. If you use "appendcols" instead, it will give you the results of both charts within one timeframe (overlapping instead of side by side).

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...