How can I Overlay chart with two fields?

[indeed_2000]

Hi 

I have two fields: target (server1, server2,…) , status count by (ok,nokey)

how can i show these fields on timechart? (I mean overlay chart)

stack bar chart show count of status by target?

any idea?

 Thanks 

[gcusello · Accepted solution]

Hi @indeed_2000,

please try this:

your_search
| bin span=1h _time
| stats count(eval(status="ok")) AS OK count(eval(status="nok")) AS NOK by target _time

Ciao.

Giuseppe

[ITWhisperer]

| timechart count by target

This should give you counts for each target against each time value.

When visualised, the timeline will be the x-axis, and you should have a line (for line chart) or column (for column chart) etc. for each series (target)

If you want, you can select one or more of these series as an overlay line on a column chart.