topic Re: How to combine my two searches and create a time chart with the resulting data? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-two-searches-and-create-a-time-chart-with-the/m-p/199999#M57953 <P>Worked like a charm ...thanks </P> Wed, 13 Apr 2016 18:12:00 GMT prakashbhanu407 2016-04-13T18:12:00Z How to combine my two searches and create a time chart with the resulting data? https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-two-searches-and-create-a-time-chart-with-the/m-p/199997#M57951 <P>I have to add 2 searches. Each search's output is FileName and Time....and I have to create a graph with the 2 types of file counts against time.</P> <P>I used the search below:</P> <PRE><CODE>index=MyIndex ( (filename=PNASC.HRBDT.*) OR (filename=PNASC.MBRETRAN.*) ) status=1 |rename filename as FileNameA, _time as Time | table "FileNameA" status append status [ search index=MyIndex ( (filename=CFCF.GRP*.txt) OR (filename=CFCF.MBR*.txt) ) status=1 |rename filename as "FileNameB", _time as Time |table "FileNameB" status ] timechart span=1d count("FileNameA") count("FileNameB") </CODE></PRE> <P>but getting errors</P> <P>tried Join too, but I don't have any common field with same values.</P> Wed, 13 Apr 2016 14:36:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-two-searches-and-create-a-time-chart-with-the/m-p/199997#M57951 prakashbhanu407 2016-04-13T14:36:47Z Re: How to combine my two searches and create a time chart with the resulting data? https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-two-searches-and-create-a-time-chart-with-the/m-p/199998#M57952 <P>Try like this (assuming all data lies in same MyIndex)</P> <PRE><CODE>index=MyIndex filename=PNASC.HRBDT.* OR filename=PNASC.MBRETRAN.* OR filename=CFCF.GRP*.txt OR filename=CFCF.MBR*.txt status=1 | eval Type=if(like(filename,"PNASC.HRBDT.%") OR like(filename,"PNASC.MBRETRAN.%"),"FileNameA","FileNameB") | timechart span=1d count by Type </CODE></PRE> Wed, 13 Apr 2016 14:44:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-two-searches-and-create-a-time-chart-with-the/m-p/199998#M57952 somesoni2 2016-04-13T14:44:35Z Re: How to combine my two searches and create a time chart with the resulting data? https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-two-searches-and-create-a-time-chart-with-the/m-p/199999#M57953 <P>Worked like a charm ...thanks </P> Wed, 13 Apr 2016 18:12:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-my-two-searches-and-create-a-time-chart-with-the/m-p/199999#M57953 prakashbhanu407 2016-04-13T18:12:00Z