Combining two graphs into ONE

[macadminrohit]

Hi Have the below Searches , most of which are common, only different is i am doing a regex in one of them to compare the string with a number. I am not sure if i can use a streamstats to combine two searches together to avoid running the search twice. Basically i want to combine the two graphs into one i.e one search will give a line graph and another will give a bar graph, like an overlay. With Same x-axis i.e count .

index=servers sourcetype=xs_json Name="Server App" Version=*
| bucket _time span=1h
| timechart count AS HTTP_COUNT by Url useother=f usenull=f limit=50
| fillnull value=0

index=servers sourcetype=xs_json Name="Server App" Version=*
| bucket _time span=1h
| rex field=_raw "Response Code\",\"value\":\"(?<RespCode>\w+)\"}," | where RespCode!=200
| timechart count AS ERROR_COUNT by Url useother=f usenull=f limit=50
| fillnull value=0

[adonio · Accepted solution]

hello there,

you can use conditional eval in timechart as well

 index=servers sourcetype=xs_json Name="Server App" Version=* 
| bucket _time span=1h 
| rex field=_raw "Response Code\",\"value\":\"(?<RespCode>\w+)\"}," 
| timechart count(eval(RespCode>200) AS ERROR_COUNT count as HTTP_COUNT by Url useother=f usenull=f limit=50 
| fillnull value=0

hope it helps

[macadminrohit]

Basically i dont want to combine the queries to get a single query, i want two graphs into an overlay. First query results into a bar graph and the second results into a line chart. I want those two graphs to overlay.

[adonio]

use the chart overlay function in the viz
have it as a bar chart and then pick the field you want for chart overlay

[macadminrohit]

Thank you so Much Adonio. It works like a champ.