Can this query be written more efficiently?

[dfexsplunk]

It's a query for a staked column chart.

index=myCompIn source="/locatedin/mySrc.log" "Reply Back" "CAT-IN " "SOME STUFF" | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false true false)"] | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false false true)"]|timechart span=1d count AS aTXN | join _time
[search index=myCompIn source="/locatedin/mySrc.log" RT_DCC_TYPE=converted | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false true false)"] | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false false true)"] | timechart span=1d count AS bTXN]

[somesoni2 · Accepted solution]

Try this

index=myCompIn source="/locatedin/mySrc.log" ("Reply Back" "CAT-IN " "SOME STUFF") OR ("CAT-IN | 91.8.1952.7.4 | (false true false)" ) OR ("CAT-IN | 91.8.1952.7.4 | (false false true)") OR ( RT_DCC_TYPE=converted ) OR ( "CAT-IN | 91.8.1952.7.4 | (false true false)") OR ( "CAT-IN | 91.8.1952.7.4 | (false false true)" ) 
| eval catin=case(searchmatch("CAT-IN | 91.8.1952.7.4 | (false true false)",1,searchmatch("CAT-IN | 91.8.1952.7.4 | (false false true)",1,true(),0)
| eval aTXN=if(searchmatch("\"Reply Back\" \"CAT-IN \" \"SOME STUFF\""),1,0) + catin
| eval bTXN=if(searchmatch("RT_DCC_TYPE=converted"),1,0) + catin
| timechart span=1d sum(aTXN) as aTXN sum(bTXN) as bTXN

[dfexsplunk]

This worked exactly. Tanx very much.

[sundareshr]

Try this
*UPDATED*

index=myCompIn source="/locatedin/mySrc.log" "Reply Back" "CAT-IN | 91.8.1952.7.4" | timechart span=1d  count(eval(match(_raw, "SOME STUFF")) as A count(eval(RT_DCC_TYPE="converted")) as B

[dfexsplunk]

Thanks for this sundareshr but no luck with it, I get the following error "Error in 'timechart' command: Repeated group-by field '_time'."

[sundareshr]

Try the updated answer.

[dfexsplunk]

Tanx. Still the same error code produced.

[sundareshr]

🙂 try this time

[dfexsplunk]

Tanx. This runs without error but does not find any results!

[sundareshr]

Do you get any data back when you remove the last segment (timechart)?