topic Append 3 timecharts in a graph ? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Append-3-timecharts-in-a-graph/m-p/475123#M133555 <P>Hi,<BR /> I have two timecharts that I appended using appendcols. Now I have another query that I want to append as well but append cols only appends two searches? I can't use match and case because it is different fields?</P> <PRE><CODE>earliest=-1d@d latest=@d host="NETWEBA*" sourcetype="WinEventLog:Application" AND ApplicationSource="/order*" AND "ErrorGUID" | timechart span=1h count AS "Order20" | appendcols [search earliest=-1d@d latest=@d host="NETAPPA*" sourcetype="WinEventLog:Application" AND AppDomainName= EcomSubscription.* AND "ErrorGUID" | timechart span=1h count AS "EcomSubscription" ] </CODE></PRE> <P>Query I'm trying to insert:</P> <PRE><CODE> host=NETAPPA* AND LogName=Application AND Monster.Services.Windows.ServiceBase. AND Message="MonsterWindowsService" sourcetype="WinEventLog:Application" </CODE></PRE> Wed, 11 Sep 2019 03:52:23 GMT lsy9891 2019-09-11T03:52:23Z Append 3 timecharts in a graph ? https://community.splunk.com/t5/Splunk-Search/Append-3-timecharts-in-a-graph/m-p/475123#M133555 <P>Hi,<BR /> I have two timecharts that I appended using appendcols. Now I have another query that I want to append as well but append cols only appends two searches? I can't use match and case because it is different fields?</P> <PRE><CODE>earliest=-1d@d latest=@d host="NETWEBA*" sourcetype="WinEventLog:Application" AND ApplicationSource="/order*" AND "ErrorGUID" | timechart span=1h count AS "Order20" | appendcols [search earliest=-1d@d latest=@d host="NETAPPA*" sourcetype="WinEventLog:Application" AND AppDomainName= EcomSubscription.* AND "ErrorGUID" | timechart span=1h count AS "EcomSubscription" ] </CODE></PRE> <P>Query I'm trying to insert:</P> <PRE><CODE> host=NETAPPA* AND LogName=Application AND Monster.Services.Windows.ServiceBase. AND Message="MonsterWindowsService" sourcetype="WinEventLog:Application" </CODE></PRE> Wed, 11 Sep 2019 03:52:23 GMT https://community.splunk.com/t5/Splunk-Search/Append-3-timecharts-in-a-graph/m-p/475123#M133555 lsy9891 2019-09-11T03:52:23Z