Dashboards & Visualizations

Hi, I currently have two quires and I have separate graph for each one of them for over a week data, But I want to merge both the graphs as line chart or Column chart into a single graph

divakarr996
New Member

Query 1 -
host="fmvmprdpreset1" OR host="fmvmprdpreset2" OR host="egvmprdpreset1" sourcetype=passreset (("Reset" AND "password successfully") OR "ACDB was reset successfully" OR "ResetGappsPassword successfully" OR "Get recovery key successfully") OR ("The password doesnt comply history requirement" OR ("Reset" AND "password failed") OR "ACDB was failed to reset" OR "ResetGappsPassword failed" OR ("Reset" AND "faceless failed") OR "Get recovery key failed") earliest=-7d@d
|top limit=12 date_wday|sort date_wday

Query 2 -
host="fmvmprdpreset1" OR host="fmvmprdpreset2" OR host="egvmprdpreset1" sourcetype=passreset (("Reset" AND "password successfully") OR "ACDB was reset successfully" OR "ResetGappsPassword successfully" OR "Get recovery key successfully") earliest=-7d@d|top limit=12 date_wday|sort date_wday

alt text

Please help me to merge these two graphs into a single graph over a Week data

Thank you in advance

0 Karma

to4kawa
Ultra Champion
host="fmvmprdpreset1" OR host="fmvmprdpreset2" OR host="egvmprdpreset1" sourcetype=passreset (("Reset" AND "password successfully") OR "ACDB was reset successfully" OR "ResetGappsPassword successfully" OR "Get recovery key successfully") OR ("The password doesnt comply history requirement" OR ("Reset" AND "password failed") OR "ACDB was failed to reset" OR "ResetGappsPassword failed" OR ("Reset" AND "faceless failed") OR "Get recovery key failed") earliest=-7d@d
|chart limit=0 count(eval(searchmatch("successfully"))) as successful count as total by date_wday
| sort date_wday

hi, @divakarr996
how about this?

0 Karma

divakarr996
New Member

Thank you so much for this, it worked 🙂

0 Karma

to4kawa
Ultra Champion

I see. please accept my answer.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...