Splunk Search

Append 3 timecharts in a graph ?


I have two timecharts that I appended using appendcols. Now I have another query that I want to append as well but append cols only appends two searches? I can't use match and case because it is different fields?

earliest=-1d@d latest=@d host="NETWEBA*" sourcetype="WinEventLog:Application" AND ApplicationSource="/order*" AND "ErrorGUID" | timechart span=1h count AS "Order20" | appendcols [search earliest=-1d@d latest=@d host="NETAPPA*" sourcetype="WinEventLog:Application" AND AppDomainName= EcomSubscription.* AND "ErrorGUID" | timechart span=1h count AS "EcomSubscription" ]

Query I'm trying to insert:

  host=NETAPPA* AND LogName=Application AND Monster.Services.Windows.ServiceBase. AND Message="MonsterWindowsService" sourcetype="WinEventLog:Application"
0 Karma