I'm trying to add a new series to my line chart from my dashboard's xml file.
(Which means I want to display 2 lines on my chart).
So far I have the following:
<?xml version='1.0' encoding='utf-8'?>
NOTE: This file was automatically generated by Splunk. Use caution when editing manually.
<label>SLU CPU PERFORMANCE</label>
<searchString>source="*slu*" CPU_IDLE_USAGE="*" | timechart max(CPU_IDLE_USAGE)</searchString>
... and I would like to add the CPU_SYS_USAGE="*" field as a series to this chart.
Thank you in advance.
I suppose all you should need to do is use:
source=*slu* | timechart max(CPU_IDLE_USAGE) max(CPU_SYS_USAGE)
(or average(CPU_SYS_USAGE) or some other aggregator function besides max() if you prefer).
View solution in original post
Use max() and set the span to be lower than the time between data points so you only capture one data point in a span.
Now, what if I don't want to plot a max() or an avg()?
I just want to show the numbers that CPU_IDLE_USAGE have.
_time CPU_ID CPU_IDLE_USAGE
8/23/10 11:25:00.000 PM 0 90
8/23/10 11:20:00.000 PM 0 83
8/23/10 11:15:00.000 PM 0 81
8/23/10 11:10:00.000 PM 0 82
8/23/10 11:05:00.000 PM 0 88
8/23/10 11:00:00.000 PM 0 78
I would like to plot the following values: 90, 83, 81, 82, 88... etc. How can I do that?
Thank you again