Splunk Search

multiple search results on singlechart

ChhayaV
Communicator

hi,

these are my searches

index=tm_idx host="audit" | timechart count by Process usenull="f"

index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"

I want to show result of these searches on a single chart

1 Solution

HiroshiSatoh
Champion

I think it is good if you use the append.

index=tm_idx host="audit" | timechart count by Process usenull="f"|append [search index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"]

View solution in original post

HiroshiSatoh
Champion

I think it is good if you use the append.

index=tm_idx host="audit" | timechart count by Process usenull="f"|append [search index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"]

zeroactive
Path Finder

Using "append" will give you a two charts side by side with the timeframe repeated. If you use "appendcols" instead, it will give you the results of both charts within one timeframe (overlapping instead of side by side).

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...