I have a use case where I want to chart system utilization vs incoming requests. This is really helpful in data correlation. Let's say I have the incoming requests in index=requests and system utilization maintained in index=nmon. I need to timechart
both of these data points in the same chart where utilization needs to be a line chart and requests will be a bar graph.
Can you please suggest how I can accomplish this use case?
@dhilipvenkatesh ,
You may try using overlay
(index=requests OR index=nmon)|timechart avg(requests) as requests,avg(utilization) as utilization
Select visualization as column chart and in the format - > Chart Overlay select utilization
in overlay
Reference : https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchTutorial/Chartoverlays