Splunk Search

multiple search results on singlechart

ChhayaV
Communicator

hi,

these are my searches

index=tm_idx host="audit" | timechart count by Process usenull="f"

index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"

I want to show result of these searches on a single chart

1 Solution

HiroshiSatoh
Champion

I think it is good if you use the append.

index=tm_idx host="audit" | timechart count by Process usenull="f"|append [search index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"]

View solution in original post

HiroshiSatoh
Champion

I think it is good if you use the append.

index=tm_idx host="audit" | timechart count by Process usenull="f"|append [search index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"]

zeroactive
Path Finder

Using "append" will give you a two charts side by side with the timeframe repeated. If you use "appendcols" instead, it will give you the results of both charts within one timeframe (overlapping instead of side by side).

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>