https://community.splunk.com/t5/Splunk-Search/How-to-separate-the-fields-AppDomainName-and-ApplicationSource/m-p/473390#M133202 <P>Hi <BR /> I have this query that counts the number of errors for two applications but I get the application names from different fields-one from appdomainname and one from application source. I want these two different applications to display as two different lines in my chart. I tried this but it only shows EcomSubscription as a bar chart?</P> <PRE><CODE>earliest=-1d@d latest=@d host="NETAPPA*" sourcetype="WinEventLog:Application" AND (AppDomainName= EcomSubscription.* OR ApplicationSource="/order*") AND "ErrorGUID" | eval application = AppDomainName.":".ApplicationSource | timechart span=1h count BY application </CODE></PRE> Fri, 06 Sep 2019 08:02:29 GMT lsy9891 2019-09-06T08:02:29Z https://community.splunk.com/t5/Splunk-Search/How-to-separate-the-fields-AppDomainName-and-ApplicationSource/m-p/473390#M133202 <P>Hi <BR /> I have this query that counts the number of errors for two applications but I get the application names from different fields-one from appdomainname and one from application source. I want these two different applications to display as two different lines in my chart. I tried this but it only shows EcomSubscription as a bar chart?</P> <PRE><CODE>earliest=-1d@d latest=@d host="NETAPPA*" sourcetype="WinEventLog:Application" AND (AppDomainName= EcomSubscription.* OR ApplicationSource="/order*") AND "ErrorGUID" | eval application = AppDomainName.":".ApplicationSource | timechart span=1h count BY application </CODE></PRE> Fri, 06 Sep 2019 08:02:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-separate-the-fields-AppDomainName-and-ApplicationSource/m-p/473390#M133202 lsy9891 2019-09-06T08:02:29Z https://community.splunk.com/t5/Splunk-Search/How-to-separate-the-fields-AppDomainName-and-ApplicationSource/m-p/473391#M133203 <P>|eval application = if (isnotnull(AppDomainName),AppDomainName,ApplicationSource) |timechart &lt;..rest of the stuff&gt;</P> Fri, 06 Sep 2019 11:56:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-separate-the-fields-AppDomainName-and-ApplicationSource/m-p/473391#M133203 Sukisen1981 2019-09-06T11:56:17Z