I have two search results:
1. I have a table with list of values for products over a time range
2. I have a table with list of values plotted over field counts and uses range map.
I want to combine these two into a single view that shows time range on top and the values in the cells of the table, and then have it show colored marks for particular ranges.
6/12/2015 7/12/2015 8/12/2015
prod1 0 10 100
prod2 10 15 25
prod3 100 0 100
The problem is not in the color . merging the content of two tables.
i..e one table has time range as x-axis and the other has fields
basically I want to merge the output of the below two:
sourcetype=File* ID=* | dedup ID | stats count by ID| rangemap field=count low=0-100 elevated=101-1000
sourcetype=File* ID=* | dedup ID | bucket span=1h _time | eval formatted_time=strftime(_time, "%c") | chart count over ID by formatted_time
I got to a partial solution to this issue as below:
eventtype="Myevent" source="Mysource" ID=* | dedup ID | transaction ID | bin span=1d _time | eval formatted_time=strftime(_time, "%c") | eval Status="Pass" | chart values(Status) over ID by formatted_time
similarly I used other fields to plot required values.
coloring is the only challenge I have now .