Hello! I want to create something like this but I want to put them on the same chart and not use the trellis view. My query goes like this:
index="tcpr-dispatcher" host=* sourcetype=DispatcherLogs FinalState=TERMINAL OR FinalState=COMPLETE
|where Module in ("nxtransdirect","proetojt","sep_cid_coversheet") OR (Module in ("previewservice") AND isnotnull(extension))
|timechart count(eval(FinalState="TERMINAL")) as TERMINAL, count(eval(FinalState="COMPLETE")) as COMPLETE span=1month by host
Please help.
Is there a way to put them both the bars on a single scale?