Assuming I'm showing events on a timeline, say for example, `timechart count(sign_ins) by date_hour`
date_hour | user sign ins
10 | 120
11 | 151
12 | 122
13 | 100
14 | 532
15 | 332
And then I wish to show some markers on that timeline, e.g. `stats first (promo_email) by date_hour`
date_hour | email sent
10 | 'bacn'
13 | 'free stuff'
How could I represent the relationship between these two concepts in the same chart/report/dashboard?
Edit:
The relationship between them being that an event in the second search could cause a spike in the first search but splunk does not seem to have a way to draw lines/markers to show these.
↧