I want to plot a single graph for two different searches .

[jsamadhan]

I am running two search queries-

1st to get count of requests received -
"Received Request-ID-->" | rex ">(?\S+) " | eval Application=case(areqstat LIKE "BTMS%","BTMS",areqstat LIKE "EVSN%","EVSN_Application",areqstat LIKE "DFLW%","DFLW_Application",areqstat LIKE "IDAP%", "IDAP Application",areqstat LIKE "ISF%","ISF Application",areqstat LIKE "ROLB%", "ROLB", 1=1, "Other") | stats count by Application

2nd to get count of responses sent -
Response_for_Request="Response sent for request Id" | rex "request Id - (?\S+) " | eval Application=case(areqstat LIKE "BTMS%","BTMS",areqstat LIKE "EVSN%","EVSN_Application",areqstat LIKE "DFLW%","DFLW_Application",areqstat LIKE "IDAP%", "IDAP Application",areqstat LIKE "ISF%","ISF Application",areqstat LIKE "ROLB%", "ROLB", 1=1, "Other") | stats count by Application

I want to plot a single graph where request received vs response sent count can be plotted for same application.

Any suggestion?

[somesoni2 · Accepted solution]

Try like this

("Received Request-ID-->") OR (Response_for_Request="Response sent for request Id") 
| rex "\>(?<areqstat1>\S+) " | rex "request Id - (?<areqstat2>\S+) " | eval areqstat=coalesce(areqstat1,areqstat2) 
| eval Application=case(areqstat LIKE "BTMS%","BTMS",areqstat LIKE "EVSN%","EVSN_Application",areqstat LIKE "DFLW%","DFLW_Application",areqstat LIKE "IDAP%", "IDAP Application",areqstat LIKE "ISF%","ISF Application",areqstat LIKE "ROLB%", "ROLB", 1=1, "Other") 
| eval type=if(searchmatch("Received Request-ID-->"),"received_count","sent_count")
| chart count over Application by type

[cmerriman]

if you can have the base search have both sourcetypes/indexes, i'd suggest putting this all in one search. write an eval that says if it is received or sent using the source or field that would tell you that. ie: |eval type=if(index=isnotnull(Response_for_Request),"sent","received") and then |stats count by Application type