Dashboards & Visualizations

Hi, I currently have two quires and I have separate graph for each one of them for over a week data, But I want to merge both the graphs as line chart or Column chart into a single graph

divakarr996
New Member

Query 1 -
host="fmvmprdpreset1" OR host="fmvmprdpreset2" OR host="egvmprdpreset1" sourcetype=passreset (("Reset" AND "password successfully") OR "ACDB was reset successfully" OR "ResetGappsPassword successfully" OR "Get recovery key successfully") OR ("The password doesnt comply history requirement" OR ("Reset" AND "password failed") OR "ACDB was failed to reset" OR "ResetGappsPassword failed" OR ("Reset" AND "faceless failed") OR "Get recovery key failed") earliest=-7d@d
|top limit=12 date_wday|sort date_wday

Query 2 -
host="fmvmprdpreset1" OR host="fmvmprdpreset2" OR host="egvmprdpreset1" sourcetype=passreset (("Reset" AND "password successfully") OR "ACDB was reset successfully" OR "ResetGappsPassword successfully" OR "Get recovery key successfully") earliest=-7d@d|top limit=12 date_wday|sort date_wday

alt text

Please help me to merge these two graphs into a single graph over a Week data

Thank you in advance

0 Karma

to4kawa
Ultra Champion
host="fmvmprdpreset1" OR host="fmvmprdpreset2" OR host="egvmprdpreset1" sourcetype=passreset (("Reset" AND "password successfully") OR "ACDB was reset successfully" OR "ResetGappsPassword successfully" OR "Get recovery key successfully") OR ("The password doesnt comply history requirement" OR ("Reset" AND "password failed") OR "ACDB was failed to reset" OR "ResetGappsPassword failed" OR ("Reset" AND "faceless failed") OR "Get recovery key failed") earliest=-7d@d
|chart limit=0 count(eval(searchmatch("successfully"))) as successful count as total by date_wday
| sort date_wday

hi, @divakarr996
how about this?

0 Karma

divakarr996
New Member

Thank you so much for this, it worked 🙂

0 Karma

to4kawa
Ultra Champion

I see. please accept my answer.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...