Splunk Search

How do I chart 2 searches on one chart?

afamoyib
Path Finder

Searches

index=nix sourcetype=cpu host="host a"  CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host

index=nix source=vmstat sourcetype=vmstat tag=memory host="host a"  | timechart limit=0 max(memUsedPct) by host
0 Karma

livehybrid
Builder

Here is a simpler example of how this might work:
index=* | timechart count by source | append [search index=* | timechart count by sourcetype]

For your search this might work:

index=nix sourcetype=cpu host="host a" CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host | append [search index=nix source=vmstat sourcetype=vmstat tag=memory host="host a" | timechart limit=0 max(memUsedPct) by host]
0 Karma

afamoyib
Path Finder

It does not seem to work. It is displaying 3 charts instead of 2

0 Karma

livehybrid
Builder

Are you able to upload a picture so I can see what it looks like?
Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...