Query "index=idx1 sourcetype=src1 sender="xyz" | timechart count as res1" showing results properly, and
Query "index=idx1 sourcetype=src1 sender="abc" | timechart count as res2" not showing any result.
when I am trying to combine both the queries as below:
index=idx1 sourcetype=src1 sender="xyz" | timechart count as res1 | appendcols [search index=idx1 sourcetype=src1 sender="abc" | timechart count as res2] | fillnull res1, res2
it is giving result, but no value for _time field .
how I can get values for _time field.
pls help me....
Joined Query
"index=idx1 sourcetype=src1 sender="xyz" OR sender="abc" | timechart count by sender
This is significantly more efficent than the options above. It makes a single pass in the index and sourcetype to pull the data and populates the chart. Before you have to query the same data twice to pull information. Then you have to join the two results before charting.
Try something like this
index= idx1 sourcetype=src1 sender="abc" OR sender="xyz" | timechart count(eval(sender="abc") as res1 count(eval(sender="xyz") as res2
Hello,
Rather than appending the result
just do the below
index=idx1 sourcetype=src1 OR sourcetype=src2|timechart count by sourcetype
Thanks,
L