Splunk Search

timechart - how do I combine these two charts into one?

zzztimbo
Engager

I have the following query:

... | timechart avg(Latency)

Can I combine this with:

... | timechart count by responseCode

Basically I'd like to have these two charts share the same Y-axis.

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

Only way I can think of is the somewhat brute force way of using appendcols and running the search twice:

<your search> | timechart span=1d count by responsecode | appendcols [ <your search> | timechart avg(Latency) as avgLatency | fields avgLatency ]

However maybe someone else can see some nutty way of using bin _time and stats to get you there.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Only way I can think of is the somewhat brute force way of using appendcols and running the search twice:

<your search> | timechart span=1d count by responsecode | appendcols [ <your search> | timechart avg(Latency) as avgLatency | fields avgLatency ]

However maybe someone else can see some nutty way of using bin _time and stats to get you there.

abhayneilam
Contributor

Awesome, helped me a lot !!

Thanks !!

0 Karma

nnips
Engager

thanks you so much

0 Karma

dreamwork801
Path Finder

Helped me too!

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...