Overlay two searches with different colors

[warok]

I want to create one single graphe, but with two different colors for each searches.
So, create overlay of the two search is easy with OR, but how can I colorize the plots with distinct colors?
Currently, I'm stuck at

vhost=x OR vhost=y

Thanks for the help

[to4kawa]

hi, @warok
what's your query?
vhost=x OR vhost=y is not work.

| makeresults
| eval vhost=split("x,y",",")
| stats count by vhost
| eval count=random() % 100
`comment("check this result")`
| transpose 0 header_field=vhost column_name=count

Do you want like above?

[warok]

Hi @to4kawa,
(Sorry beginner with splunk), but your command don't give me any output:
makeresults
| eval vhost=split("sso-inactive-dev.sbb.ch,sso-dev.sbb.ch",",")
| stats count by vhost
| eval count=random() % 100
comment("check this result")
| transpose 0 header_field=vhost column_name=count
Can you explain me, what I am doing wrong?
Thanks

[to4kawa]

makeresults
⇨
| makeresults

[warok]

But if I do
index="wez_fw" vhost=sso-inactive-dev.sbb.ch OR vhost=sso-dev.sbb.ch
| makeresults
| eval vhost=split("sso-inactive-dev.sbb.ch,sso-dev.sbb.ch",",")
| stats count by vhost
| eval count=random() % 100
comment("check this result")
| transpose 0 header_field=vhost column_name=count
I get an error saying that "makeresults" must be first :

What I'm doing wrong?

[to4kawa]

index="wez_fw" vhost="sso-inactive-dev.sbb.ch" OR vhost="sso-dev.sbb.ch"
| stats count by vhost
| transpose 0 header_field=vhost column_name=count

cf. makeresults