all good answers here is a working example: | makeresults count=3 | streamstats count as a | eval a=a+1 | streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 | delta a as a_dif p=1 ... View more

tks, kind of but slightly different. have got mie sorted for now. ... View more

why didn't you say so 🙂 tks. Ill look at doing some preprcessing or as I like to call it fiddling 🙂 But I do think it would be good as an option to be able to stack the chartoverlay, in my case here I am trying to do it on the 2nd y axis, my 2 cents. ... View more

checked that with my different data set and pretty sure they are not stacked. hard to confim with my dataset, In your example above I think splunkd and splunkd_ui_access are not stacked.I am not sure but if they were splunkd(the green line) would jump up when splunkd_ui_access jumps up(around 10.55pm). thoughts? ... View more

thats what I thought. not working on my data. can I just confirm that you know that splunkd and splunkd_ui_access are stacked there? Can I have the search to see if i can reproduce at my end? tks ... View more

tks, I got that to work now search1 | append [search search2] | stats values(*) as * by _time and the graphing for some reason works better compared with the join option(a q i asked here). which leads me to another question "can i have a chartoverlay, with 2 serieses, stacked in splunk graph" ... View more

no, kpi2 and predict_kpi2 are blank, they only get values later on but caan't be seen in this sample set.tks ... View more

fills all the blanks with 0 but the stacking still does not work. there is only 97 rows of data. splunk should be abble to handle this? ... View more

@ppablo, hope this explains how the sample data aligns. 179 is kpi1 299 is predict_kpi1 21586.06208 is predict_kpi1 27442.36503 is predict_kpi2 ... View more

@somesoni2 got this to work search1 | join type=outer _time [search search2] | the problem now that the chart is not doing a stacked area chart for all 4 series in the graph...sigh!! (see my edit1 in question above) ... View more

maybe I should use join? how do I join using the _time column from the 2 searches to line up? ... View more

I could not get this to work. the order of the searches give a different result, but ultimately the dates did not align. I try to explain the results below. search1 - 2010-09 to future date search2 - 2015-07 to future date search1 | append [search search2] | stats values(*) as * by _time gives 2010-09 to future date values with 2015-07 from search 2 alligned with 2010-09 from search1 search2 | append [search search1] | stats values(*) as * by _time gives 2015-07 to future date values with 2010-09 from search 1 alligned with 2015-07 from search2 ... View more

this gives me the below: but maybe i am missing something. how do i allign dat1 and date2? date1 source count1 count2 date2 sourcetype 1 2016-02 C:\Apps\Splunk\var\log\splunk\conf.log 1 0 2016-03 kvstore 2 2016-02 C:\Apps\Splunk\var\log\splunk\metrics.log 63857 3 2016-02 C:\Apps\Splunk\var\log\splunk\mongod.log 150 4 2016-02 C:\Apps\Splunk\var\log\splunk\scheduler.log 39 5 2016-02 C:\Apps\Splunk\var\log\splunk\splunkd-utility.log 13 6 2016-02 C:\Apps\Splunk\var\log\splunk\splunkd.log 853 7 2016-02 C:\Apps\Splunk\var\log\splunk\splunkd_access.log 396 8 2016-02 C:\Apps\Splunk\var\log\splunk\splunkd_ui_access.log 24763 9 2016-02 C:\Apps\Splunk\var\log\splunk\web_access.log 226 10 2016-02 C:\Apps\Splunk\var\log\splunk\web_service.log 309 11 2016-03 C:\Apps\Splunk\var\log\splunk\conf.log 29 12 2016-03 C:\Apps\Splunk\var\log\splunk\metrics.log 1601158 13 2016-03 C:\Apps\Splunk\var\log\splunk\metrics.log.1 293 14 2016-03 C:\Apps\Splunk\var\log\splunk\mongod.log 2822 15 2016-03 C:\Apps\Splunk\var\log\splunk\scheduler.log 1030 16 2016-03 C:\Apps\Splunk\var\log\splunk\splunkd-utility.log 377 17 2016-03 C:\Apps\Splunk\var\log\splunk\splunkd.log 15553 18 2016-03 C:\Apps\Splunk\var\log\splunk\splunkd_access.log 4491 19 2016-03 C:\Apps\Splunk\var\log\splunk\splunkd_ui_access.log 113037 20 2016-03 C:\Apps\Splunk\var\log\splunk\web_access.log 922 21 2016-03 C:\Apps\Splunk\var\log\splunk\web_service.log 6913 ... View more

like predict don't think this can be done see here ... View more

Means the columns names are dynamic?? So if the the fields are a,b,c,d then i have to hard code this with table _time d c b a to reverse it as the default is to sort it alphabetically. what if the fields where q,r,s,t, my search would not work or if the fields where 6,7,8,9. I want to be able to control the sorting no matte what the fields are. Can this be done without hardcoding? ... View more

tks. why rename starttime as _time it seems to work just using table _time d c b a But I should have said in the question, I am looking for it to work on dynamic data, so don't want it hardcoded. Is there a way to do it with dynamic data? ... View more

tks but that did not matter, full example for reference. | makeresults count=2 | streamstats count as A | eval A=A+1 | streamstats count as b | eval b=b+10 | streamstats count as c | eval c=c+11 | appendpipe [ streamstats window=1 current=f last(b) as last_b last(a) as last_a last(c) as last_c | tail 1 | eval b=b/last_b | eval a=a/last_a | eval c=c/last_c | eval _time="something else" | fields - last*] ... View more

tks but I got this to work by simply doing eval _time="something else" | ... View more

tks, that gives me _time a b 1 2016-03-14 09:49:32 2 1 2 2016-03-14 09:49:32 3 2 3 2016-03-14 09:49:32 1.500000 2 but how do I control the 3rd row value for _time to be something else as opposed to 2016-03-14 09:49:32 ? I could use this but I don't think the approach would work, unless know the values of b and c in row 3. ... View more

tks, | timechart span=h count | stats sum(count) as total dc(_time) as numRows | eval percent=total/(numRows*2)*100 just had to add the brackets. ... View more