Overlay 2 queries on same chart

[luckyman80]

Hi Experts,

                    I'm stuck trying to show two queries on the same chart. The result sets should be pretty similar (so no issue with the axis) but it seems to show either the 1000 search or the 1001 search only and not together. I'm prob not adding them as independent queries correctly to show on the same graph!  Both work on their own without any issues but when combining it doesn't work. 

Example

index=someindex "1000" sourcetype="somesourcetype-logs" [search index=someindex "1001" sourcetype="somesourcetype"]

| `splitl`

| rex "1000=(?<NewRequest>.*?);"

| rex "1001(?<RejectedRequest>.*?);"

| rex field=source "somesource(?<instance>.*?)\b"

| dedup NewRequest,RejectedRequest

| where isnotnull(NewRequest)

| where isnotnull(RejectedRequest)

| timechart count(NewRequest), count(RejectedRequest) by instance

Any help would be great 

[ITWhisperer]

Try this (which will append the events from the second search to the first, but it is unclear whether this is what you want or not)

index=someindex "1000" sourcetype="somesourcetype-logs"
| append [search index=someindex "1001" sourcetype="somesourcetype"]

[vivekarora]

I have tried the above query. The sub search is not working. I have tried using appendcols

Its working, I am attaching the screenshot for your reference.

vivekarora_0-1627710538784.png