2 searches 2 sources one chart???

[ashishv]

hello all,

i have 2 searches each with its own source, and i need to time chart that over 24 hrs in single chart? i cant figure out how to do that...

here are the searches: Search1: host="SOURCE1" PROCESSFLAG=SUCCESS| timechart span="1h" count by PROCESSFLAG

Search2: host="SOURCE2" NOT ORDER_STATUS ORDER_STATUS="Entered" OR ORDER_STATUS="Booked" | timechart span="1h" count by ORDER_STATUS

Thanks Ashish

[David · Accepted solution]

I think the following should give you what you want.

host="SOURCE1" PROCESSFLAG=SUCCESS
   | timechart span="1h" count by PROCESSFLAG 
   | join _time 
     [search host="SOURCE2" NOT ORDER_STATUS ORDER_STATUS="Entered" OR ORDER_STATUS="Booked"  
        | timechart span="1h" count by ORDER_STATUS
     ]

Let me know if that works out.

[ashishv]

Wow this is cool..
thanks