Dashboards & Visualizations

Chart data from 2 saved searches

gnovak
Builder

Hi

Is it possible to chart data from 2 saved searches? I currently have 2 charts that are generated, each using a single saved search to generate each chart. What I'd like to do is combine 2 saved searches into one chart. The chart is displaying the data in columns.

Currently the code I have in my dashboard to generate the charts is below:

<row>
<chart>
  <title>Total Emails To Send For All Registries</title>
  <searchName>balance_email_to_send</searchName>
 <option name="charting.chart">column</option>
<option name="charting.primaryAxisTitle.text">Date</option>
<option name="charting.secondaryAxisTitle.text">Number of Emails</option>
 <option name="charting.chart.useAbsoluteSpacing">true</option>
 <option name="charting.chart.columnSpacing">5</option>
 <option name="charting.legend.placement">top</option>
</chart>
<chart>
<chart>
  <title>Total Emails Sent To All Registries</title>
  <searchName>balance_email_sent</searchName>
  <option name="charting.chart">column</option>
<option name="charting.primaryAxisTitle.text">Date</option>
<option name="charting.secondaryAxisTitle.text">Number of Emails</option>
 <option name="charting.chart.useAbsoluteSpacing">true</option>
 <option name="charting.chart.columnSpacing">5</option>
 <option name="charting.legend.placement">top</option>
</chart>

How can I have both of these saved searches generate data in 1 chart? Oh and also add another color and category to the legend too.

Tags (1)
1 Solution

ziegfried
Influencer

You should be able to get a single search returning the combined results of both searches:

sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent 
| rex field=_raw "[BalanceEmail] ?(?[\d]+) of (?[\d]+) of email notification sent." 
| search TotalEmailsToSend="*" OR TotalEmailsSent="*"
| timechart sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent

View solution in original post

ziegfried
Influencer

You should be able to get a single search returning the combined results of both searches:

sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent 
| rex field=_raw "[BalanceEmail] ?(?[\d]+) of (?[\d]+) of email notification sent." 
| search TotalEmailsToSend="*" OR TotalEmailsSent="*"
| timechart sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent

gnovak
Builder

Chart generated nicely! Thanks for the help as I missed a few minor details as usual!

0 Karma

gnovak
Builder

This worked. sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(?[\d]+) of (?[\d]+) of email notification sent." | search TotalEmailsToSend="" OR TotalEmailsSent=""
| timechart sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent

0 Karma

gnovak
Builder

I'm going to play with it a little though....

0 Karma

gnovak
Builder

no go on that search...it doesn't like the regex...

0 Karma

gnovak
Builder

Here are the 2 saved searches:

Total Emails to Send search:

sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(?[\d]+) of (?[\d]+) of email notification sent." | search TotalEmailsToSend="*" | timechart sum(TotalEmailsToSend)

Total Emails Sent search:

sourcetype="cron_BalanceEmail" (source="asia" OR source="info" OR source="org") starthoursago="120" BalanceEmail sent | rex field=_raw "[BalanceEmail] ?(?[\d]+) of (?[\d]+) of email notification sent." | search TotalEmailsSent="*" | timechart sum(TotalEmailsSent)

0 Karma

Simeon
Splunk Employee
Splunk Employee

Without knowing the exact search, it is extremly difficult to advise on how to insert a second set of results into the same chart. You might be able to use the "append" command to add in a separate set of results to a specific search, then create a chart based off of that complete result set.

0 Karma

gnovak
Builder

I'll have to research the append command a bit further!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...