Dashboards & Visualizations

How to merge two timecharts in a single dashboard panel?

xbbj3nj
Path Finder

Hi All,

I want to merge two timecharts in a single panel, I have a file transmission tracker query A - which tracks when the file transmisiion occurs.

Query B - tracks the triggered alerts ( negative condition - when the file doesnt come)

A:

index="fxr" fxr_ftpup_filename="DMM02YBRYBRPACEAVAILCOLLAT_*04*" OR fxr_ftpup_filename="DMM01YBRYBRCOLLATNAV_*05*" OR fxr_ftpup_filename="DMM10YBRDMMPaceRepoedgeInstruments_*_02*" OR fxr_ftpup_filename="DMM04YBRYBRPACEREPOTRD_*04*" OR fxr_ftpup_filename="DMM04YBRYBRPACEOTCTRD_*04*"  | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) as FileTransmissionTime | rename fxr_ftpup_filename as FileName,fxr_status as Status| replace "DMM01YBRYBRCOLLATNAV_*05*" with "EXPALGONAV-BNYM TO DMM NAV","DMM02YBRYBRPACEAVAILCOLLAT_*04*" with "EXPALGOPOF-BNYM TO DMM Free Inventory","DMM10YBRDMMPaceRepoedgeInstruments_*_02*" with "EVNT- PRICE DEMAND 01:30AM","DMM04YBRYBRPACEREPOTRD_*04*" with "EXPALGOPOR-BNYM TO DMM Repo Transaction","DMM04YBRYBRPACEOTCTRD_*04*" with "EXPALGOOTC-BNYM TO DMM OTC Transaction" in FileName | timechart span=1m count by FileName

B:

index=_audit action=alert_fired ss_app=search |convert ctime(trigger_time) as Time | timechart count(ss_name) by ss_name

How to merge these both and show it in a single timechart.

vasanthmss
Motivator

Try this,

index="fxr" fxr_ftpup_filename="DMM02YBRYBRPACEAVAILCOLLAT_04" OR fxr_ftpup_filename="DMM01YBRYBRCOLLATNAV_05" OR fxr_ftpup_filename="DMM10YBRDMMPaceRepoedgeInstruments__02" OR fxr_ftpup_filename="DMM04YBRYBRPACEREPOTRD_04" OR fxr_ftpup_filename="DMM04YBRYBRPACEOTCTRD_04" | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time) as FileTransmissionTime | rename fxr_ftpup_filename as FileName,fxr_status as Status| replace "DMM01YBRYBRCOLLATNAV05" with "EXPALGONAV-BNYM TO DMM NAV","DMM02YBRYBRPACEAVAILCOLLAT_04" with "EXPALGOPOF-BNYM TO DMM Free Inventory","DMM10YBRDMMPaceRepoedgeInstruments__02" with "EVNT- PRICE DEMAND 01:30AM","DMM04YBRYBRPACEREPOTRD_04" with "EXPALGOPOR-BNYM TO DMM Repo Transaction","DMM04YBRYBRPACEOTCTRD_04" with "EXPALGOOTC-BNYM TO DMM OTC Transaction" in FileName | timechart span=1m count by FileName
| appendcols
[ search index=_audit action=alert_fired ss_app=search |convert ctime(trigger_time) as Time | timechart span=1m count(ss_name) by ss_name]
V

sk314
Builder

Have you looked at this approach? Might be what you are looking for.
http://answers.splunk.com/answers/7556/timechart-how-do-i-combine-these-two-charts-into-one.html

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...