Dashboard creation with two saved searches

[MadhuriVanga]

Hi,

I have two saved searches as follows:

1. abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=code //idCode field=payload|timechart span=1d count by operation

2. abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=returncode //returnCode field=payload|timechart span=1d count by returncode

I want the dashboard count by operation and returncode in a single dashboard. i.e., i need a timechart which has adjacent bars for each operation and within each bar there should be color coded partition based on the returncode.

Kindly help with ideas on how to achieve the same.

Thanks in advance,
Madhuri.

[alacercogitatus · Accepted solution]

I believe you want a single search and report, not dashboard. Dashboard is easy (add two different panels with your searches) but a combined graph is inherently more difficult.

Try this:

abc-RESPONSE OR def-RESPONSE|rex (?<operation>.*)(-RESPONSE)|rex "(instanceID=.*? )(?<payload>.*)...............................................................|xpath outfield=code //idCode field=payload | xpath outfield=returncode //returnCode field=payload | eval ReportKey = operation.":".returnCode | timechart span=15m count by ReportKey

[MadhuriVanga]

Hi sir,

Can we have three fields in the ReportKey? like we have 'operation' and 'returncode' can we have one more field included in the ReportKey?

Thanks in advance,
Madhuri.

[MadhuriVanga]

Hi,
Thanks a lot sir for the reply! It has helped me in getting the report right!!

Thanks once again.