Hi,
I have two timecharts that I appended using appendcols. Now I have another query that I want to append as well but append cols only appends two searches? I can't use match and case because it is different fields?
earliest=-1d@d latest=@d host="NETWEBA*" sourcetype="WinEventLog:Application" AND ApplicationSource="/order*" AND "ErrorGUID" | timechart span=1h count AS "Order20" | appendcols [search earliest=-1d@d latest=@d host="NETAPPA*" sourcetype="WinEventLog:Application" AND AppDomainName= EcomSubscription.* AND "ErrorGUID" | timechart span=1h count AS "EcomSubscription" ]
Query I'm trying to insert:
host=NETAPPA* AND LogName=Application AND Monster.Services.Windows.ServiceBase. AND Message="MonsterWindowsService" sourcetype="WinEventLog:Application"
