I have a query like this:
message="A" | timechart count AS AA | appendcols [search message="B" | timechart count AS BB]
I want to plot this on the same chart with two lines, AA and BB. But AA have a length of 20 and BB has a length of 60. I believe this is why I am not seeing any line? if so, how can I pad AA with extra 40 zeros so that it is the same length as BB?
Let's hope that you could fix it. Please add also needed indexes, source types etc. to your main query to be sure that you (and especially other users) are using correct events. It's not sure that all user have the same default search indexes as you have!