https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-data-from-3-sourcetypes/m-p/124939#M33769 <P>I want to combine my search results to one time chart. I have tried this but did give me result only from the first source.</P> <BLOCKQUOTE> <P>index="login" sourcetype="success" | timechart count | appendcols [search index="login" sourcetype="Failed" | timechart count] appendcols [search index="login" sourcetype="no-account" | timechart count]</P> </BLOCKQUOTE> Mon, 15 Sep 2014 16:07:44 GMT raindrop18 2014-09-15T16:07:44Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-data-from-3-sourcetypes/m-p/124939#M33769 <P>I want to combine my search results to one time chart. I have tried this but did give me result only from the first source.</P> <BLOCKQUOTE> <P>index="login" sourcetype="success" | timechart count | appendcols [search index="login" sourcetype="Failed" | timechart count] appendcols [search index="login" sourcetype="no-account" | timechart count]</P> </BLOCKQUOTE> Mon, 15 Sep 2014 16:07:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-data-from-3-sourcetypes/m-p/124939#M33769 raindrop18 2014-09-15T16:07:44Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-data-from-3-sourcetypes/m-p/124940#M33770 <P>Try using:</P> <PRE><CODE>index="login" sourcetype="success" OR sourcetype="Failed" OR sourcetype="no-account" | timechart count by sourcetype </CODE></PRE> <P>This'll create your initial search with all results, but your timechart will be a count split by sourcetype values.</P> Mon, 15 Sep 2014 16:50:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-data-from-3-sourcetypes/m-p/124940#M33770 srioux 2014-09-15T16:50:09Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-data-from-3-sourcetypes/m-p/124941#M33771 <P>Or, for a massive performance boost, try this under Splunk 6+:</P> <PRE><CODE>| tstats count where index="login" AND (sourcetype="success" OR sourcetype="Failed" OR sourcetype="no-account") by sourcetype _time span=auto | timechart count by sourcetype </CODE></PRE> Mon, 15 Sep 2014 16:55:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-data-from-3-sourcetypes/m-p/124941#M33771 martin_mueller 2014-09-15T16:55:38Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-data-from-3-sourcetypes/m-p/124942#M33772 <P>thanks you both, works as expected.</P> Mon, 15 Sep 2014 17:03:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-time-chart-with-data-from-3-sourcetypes/m-p/124942#M33772 raindrop18 2014-09-15T17:03:54Z