Help how to create bar chart from two different source?

[dhavamanis]

Need a help.

Can you please provide the sample query to draw the bar chart (stacked bar chart) with the below info. We have the two sources and index="idxstaging"

1. /var/log/idx/dispacher.log
   column:
   transactionid
   workertime (number)
   database_time (number)

2. /var/log/idx/api.log

   Column:
   transactionid
   apiresponse_time (number)

how can i build a bar chart based on transactionid from the above column. We want to show the each transaction how long time its spent for workertime, databasetime and apiresponse_time.

[martin_mueller · Accepted solution]

Try this:

index=idxstaging (source=/var/log/idx/dispacher.log OR source=/var/log/idx/api.log) | chart sum(worker_time) sum(database_time) sum(api_response_time) by transaction_id

Configure the chart to bar and stacked through the UI.

[martin_mueller]

I'm pretty sure that order is based on the column names alphabetically, so name them in a way that suits your ordering needs.

[dhavamanis]

Thank you, is it possible to show in this order from the bottom, apiresponsetime, workertime and databasetime (o top). because the database values are very less and not showing any results.

[martin_mueller]

Append this to your search:

... | addtotals | sort - Total | fields - Total

[dhavamanis]

It works, Thank you so much, how can i order the results based value in the chart. like highest value on top and lowest value to bottom.