It's a query for a staked column chart.
index=myCompIn source="/locatedin/mySrc.log" "Reply Back" "CAT-IN " "SOME STUFF" | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false true false)"] | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false false true)"]|timechart span=1d count AS aTXN | join _time
[search index=myCompIn source="/locatedin/mySrc.log" RT_DCC_TYPE=converted | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false true false)"] | append
[search index=myCompIn source="/locatedin/mySrc.log" "CAT-IN | 91.8.1952.7.4 | (false false true)"] | timechart span=1d count AS bTXN]
Try this
index=myCompIn source="/locatedin/mySrc.log" ("Reply Back" "CAT-IN " "SOME STUFF") OR ("CAT-IN | 91.8.1952.7.4 | (false true false)" ) OR ("CAT-IN | 91.8.1952.7.4 | (false false true)") OR ( RT_DCC_TYPE=converted ) OR ( "CAT-IN | 91.8.1952.7.4 | (false true false)") OR ( "CAT-IN | 91.8.1952.7.4 | (false false true)" )
| eval catin=case(searchmatch("CAT-IN | 91.8.1952.7.4 | (false true false)",1,searchmatch("CAT-IN | 91.8.1952.7.4 | (false false true)",1,true(),0)
| eval aTXN=if(searchmatch("\"Reply Back\" \"CAT-IN \" \"SOME STUFF\""),1,0) + catin
| eval bTXN=if(searchmatch("RT_DCC_TYPE=converted"),1,0) + catin
| timechart span=1d sum(aTXN) as aTXN sum(bTXN) as bTXN
Try this
index=myCompIn source="/locatedin/mySrc.log" ("Reply Back" "CAT-IN " "SOME STUFF") OR ("CAT-IN | 91.8.1952.7.4 | (false true false)" ) OR ("CAT-IN | 91.8.1952.7.4 | (false false true)") OR ( RT_DCC_TYPE=converted ) OR ( "CAT-IN | 91.8.1952.7.4 | (false true false)") OR ( "CAT-IN | 91.8.1952.7.4 | (false false true)" )
| eval catin=case(searchmatch("CAT-IN | 91.8.1952.7.4 | (false true false)",1,searchmatch("CAT-IN | 91.8.1952.7.4 | (false false true)",1,true(),0)
| eval aTXN=if(searchmatch("\"Reply Back\" \"CAT-IN \" \"SOME STUFF\""),1,0) + catin
| eval bTXN=if(searchmatch("RT_DCC_TYPE=converted"),1,0) + catin
| timechart span=1d sum(aTXN) as aTXN sum(bTXN) as bTXN
This worked exactly. Tanx very much.
Try this
*UPDATED*
index=myCompIn source="/locatedin/mySrc.log" "Reply Back" "CAT-IN | 91.8.1952.7.4" | timechart span=1d count(eval(match(_raw, "SOME STUFF")) as A count(eval(RT_DCC_TYPE="converted")) as B
Thanks for this sundareshr but no luck with it, I get the following error "Error in 'timechart' command: Repeated group-by field '_time'."
Try the updated answer.
Tanx. Still the same error code produced.
try this time
Tanx. This runs without error but does not find any results!
Do you get any data back when you remove the last segment (timechart)?