Splunk Search

timechart overlay

c799651
Explorer

Hi

 

I have this search which graphs calls to phone numbers

index=myindex sourcetype=mysource Number IN (5551,5555,55557,3249,2850,3353,6150)
| timechart span=1h count by Number

 

I have a different search that returns bad calls.

 

index=myindex sourcetype=mysource "1 4 3 1"
| stats count as BAD

I want to overlay the count of bad calls from search 2 on the timechart from search one

Labels (1)
0 Karma

c799651
Explorer

Thanks. The data is call records for phones calls.   Every call record has a  phone number  (which is a defined field) so in the first query  (using the IN) I'm looking for a few phone numbers that belong to a customer. The records contain details of call results. A call which has been blocked will have a string "1 4 3 1" (not a defined field).  So I want to show a graph of the  calls to the phone numbers (which the first query above does) and then overlay the blocked calls.  Only a small number of calls are blocked (contain "1 4 3 1") .

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your overlay should have the same x-axis as your main data, in your case this appears to be _time from the first query but that doesn't appear in your second query, so you would need to fix that. It isn't clear whether "1 4 3 1" is also a Number or a different field, nor whether BAD numbers are mutually exclusive with Numbers in your IN list. Please can you describe your data and what you are trying to achieve a bit more clearly

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...