How to include another field into the visual

[kelie]

I'm working with dashboards and the goal is to show a bar graph panel that displays the counts for two different fields separately
(2 bars per timespan) if possible.
The data is from the same index...the actions field(action=blocked) and category field (category=221)

I can build a visual for each individual field but having trouble combining the two.

index=url_filter action=blocked login_id="$user$"|stats count by _time |bucket _time span=1h 

I have another field not exclusive to field [action=blocked] that id like to display as well.
Any tips appreciated.

[kelie]

sorry for leaving it out but a sample search for category would have been

index=url_filter category=221 login_id="$user$"|stats count by _time |bucket _time span=1h

these answers have definitely put me on the right track with the eval

[woodcock]

Do the bucket earlier. See my answer.

[somesoni2]

Try like this (assuming calculation of count independently for both conditions). You didn't provide a query for calculation of category=221, I'm just using filter based on field category, adjust the query per yours)

index=url_filter (action=blocked login_id="$user$") OR (category=221)
| eval CountBlocked=if(action="blocked",1,0) , CountCat221=if(category=221,1,0)
| timechart span=1h sum(CountBlocked) as CountBlocked sum(CountCat221) as CountCat221

[woodcock · Accepted solution]

Like this:

index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| bucket _time span=1h
| stats count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221 BY _time

OR

index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| timechart span=1h count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221

[kelie]

this solution worked and is simplified, than you both for the answers

[woodcock]

Be sure to come back here and click Accept to close the question and also UpVote any answers or comments that were useful.