Hi I want to combine two searches ,they are as below.
search 1: source="------" X_STATUS="Ended" ID_map!=" " | table ID_map,OBJID,X_COMMITTED_START_DATE,X_COMMITTED_END_DATE | eval j2=X_COMMITTED_END_DATE
| eval j1=X_COMMITTED_START_DATE
| eval d1=strptime(j1,"%d-%b-%y")
| eval d2=strptime(j2,"%d-%b-%y")
| eval diff = (d2-d1)/86400 | rename OBJID as CONTRACTID | rename ID_map as TASK_NUMBER | join TASK_NUMBER [search source="CLASSIC_TASK_NAMES1.csv"] | table TASK_GROUP,CONTRACTID,diff,FILED_ENGG_NAME | stats sum(diff) as Total,count(CONTRACTID) as Number by FILED_ENGG_NAME | eval Average=round(Total/Number,2) | rename FILED_ENGG_NAME as "FIELD ENGG NAME" | rename Average as "Average Time Taken per Order" | table "FIELD ENGG NAME","Average Time Taken per Order".
which displays in column chart as average time taken by each field engineers to complete the order.
search 2: source="------" X_STATUS="Ended" ID_map!=" " | table ID_map,OBJID,X_COMMITTED_START_DATE,X_COMMITTED_END_DATE | eval j2=X_COMMITTED_END_DATE
| eval j1=X_COMMITTED_START_DATE
| eval d1=strptime(j1,"%d-%b-%y")
| eval d2=strptime(j2,"%d-%b-%y")
| eval diff = (d2-d1)/86400 | rename OBJID as CONTRACTID | rename ID_map as TASK_NUMBER | join TASK_NUMBER [search source="CLASSIC_TASK_NAMES1.csv"] | table TASK_GROUP,CONTRACTID,diff,FILED_ENGG_NAME | stats sum(diff) as Total,count(CONTRACTID) as no by FILED_ENGG_NAME| eval avgEngi=(Total/no) | stats sum(avgEngi) as avg,count(FILED_ENGG_NAME) as cnt by FILED_ENGG_NAME | eval ThresholdClosedTime=round(avg/cnt,2) | table FILED_ENGG_NAME,ThresholdClosedTime | chart avg(ThresholdClosedTime) by FILED_ENGG_NAME | trendline ema2(avg(ThresholdClosedTime))
which gives the trend of threshold closed time.
I want to combine two searches and display the results in one chart with search1 being the column chart and search2 being the trendline on column chart.
please help me on modules and parameters to get the same and also let me know whether queries are correct.