How can I combine two different chart queries into a single and get count

[rkishoreqa]

Hi all, 

I have two chart queries to get the success count and error count which are working as expected.  Now I want to add the both and get the total count from both columns. 

Query 1:  index=dev | rex "\"tracePoint\\\\\"\s:\s\\\\\"(?<tracePoint>[^\\\]+)" | rex "\"correlationId\\\\\"\s:\s\\\\\"(?<correlationId>[^\\\]+)" |search app="project1" OR app="project2" OR app="project3" OR app="project4" |where tracePoint="EXCEPTION" |chart count(app) over app by dc(correlationId)

Query 2:  index=dev | rex "\"tracePoint\\\\\"\s:\s\\\\\"(?<tracePoint>[^\\\]+)" | rex "\"correlationId\\\\\"\s:\s\\\\\"(?<correlationId>[^\\\]+)" |search app="project1" OR app="project2" OR app="project3" OR app="project4" |where tracePoint="END" |chart count(app) over app by dc(correlationId)

I tried with 'appendcols', but it is not working, can anyone help me on this. 

Thanks in Advance.

[ITWhisperer · Accepted solution]

Try something like this

index=dev | rex "\"tracePoint\\\\\"\s:\s\\\\\"(?<tracePoint>[^\\\]+)" | rex "\"correlationId\\\\\"\s:\s\\\\\"(?<correlationId>[^\\\]+)" |search app="project1" OR app="project2" OR app="project3" OR app="project4" |where tracePoint="EXCEPTION" OR tracePoint="END" |chart count(app) over app by tracePoint| addtotals

[rkishoreqa]

Thanks @ITWhisperer 
           It worked like a charm.