Two Types of calls in Visualization

[skoelpin]

I have 2 different events which have 'CalculateTax' and 'DeliverySchedule'. The CalculateTax event appears ~ 7,000 times daily while DeliverySchedule appears about ~3,000 times daily. I want to create a visualization (pie chart) to see the distribution between the 2 calls. The problem I'm facing is that I can only get 1 type to appear in the visualization. It is summing both CalculateTax and DeliverySchedule into one and showing the results. How do I break them up and have a color coded legend associated with each call?

My Query:

index=uv "CalculateTax*" AND "getdelivery*" | transaction maxevents=2 startswith="*Request" endswith="*Response" | timechart count

[skoelpin · Accepted solution]

I ended up writing a regex to capture the calls (delivery schedule and calculate tax) and piped it to the TOP command. This gave me the distribution of calls I was looking for

My Query:

index=uv Calls="*" | top Calls