Splunk Search

Combining two line charts displaying values from the same field name

zd00191
Communicator

I have 2 searches :`

 index=os_windows Host="usatlb9*" object="Network Interface" counter="Bytes Total/sec" |timechart span=30m max(Value) as           "Total Bytes Per Second" by host

 index=os_windows Host="usatlb9*" object="Network Interface" counter="Current Bandwidth" |timechart span=30m max(Value) as "Maximum Network Bandwidth" by host

The field name, 'Value', is the same in both searches. I want to combine both of these line charts into one line chart so that I can see the total bytes per second over the maximum network bandwidth .

Please help! Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

This will do it:

index=os_windows Host="usatlb9*" object="Network Interface" | bucket _time span=30m | stats max(Value) AS Max by _time host counter | timechart span=30m first(Max) AS "Total Bytes Per Second" last(Max) AS "Maximum Network Bandwidth" by host

You might have to swap the names around (the part after AS).
WARNING: There will be problems if you have any period of 30 minutes without at least 1 log for each object+host

View solution in original post

woodcock
Esteemed Legend

This will do it:

index=os_windows Host="usatlb9*" object="Network Interface" | bucket _time span=30m | stats max(Value) AS Max by _time host counter | timechart span=30m first(Max) AS "Total Bytes Per Second" last(Max) AS "Maximum Network Bandwidth" by host

You might have to swap the names around (the part after AS).
WARNING: There will be problems if you have any period of 30 minutes without at least 1 log for each object+host

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...