My tstats search is basically this:
| tstats summariesonly=t fillnull_value="MISSING" count from datamodel=Network_Traffic.All_Traffic where sourcetype="<blah>*" by _time | timechart span=1d sum(count)
I have used this search to create 3 seperate charts as per the below image.
Question: How can I overlay all 3 timecharts together? Is there SPL for this?
