How do I put a line graph that shows data in both indexes into one graph?

[WXY]

Hi,

I want to get a line graph with two indexes of data.

My command is index=interface sourcetype="in_t"| timechart count and index=imp sourcetype="out_t"| timechart count

What should I do?

[gcusello]

Hi WXY
try

(index=interface sourcetype="in_t") OR (index=imp sourcetype="out_t")
| timechart count

Bye.
Giuseppe

[renjith_nair · Accepted solution]

@WXY,

Try

(index=interface OR index=imp) (sourcetype="in_t" OR sourcetype="out_t")|timechart count by sourcetype