How to append 3 timecharts to one search?

[lsy9891]

Hi,
I want to count the number of events returned based on application source and display them as different timecharts. I realized appendcols only appends two timecharts and it is rather inefficient as many terms are repeated. For example, host, errorguid etc. Is there a way for me to append the third chart "TalentAnalyzer" as well?

earliest=-1d@d latest=@d host=NETWEBA* sourcetype="WinEventLog:Application"  AND ApplicationSource="/api/tcrm*"  AND "ErrorGUID" | timechart span=1h count AS "Api.TCRM" | appendcols [search earliest=-1d@d latest=@d host=NETWEBA* sourcetype="WinEventLog:Application" AND ApplicationSource="/jcm*" AND "ErrorGUID" | timechart span=1h count AS "JCM" ] | appendcols [search earliest=-1d@d latest=@d host=NETWEBA* sourcetype="WinEventLog:Application"  AND ApplicationSource="/TalentAnalyzer*" AND "ErrorGUID" | timechart span=1h count AS "TalentAnalyzer" ]

[DavidHourani]

Hi @lsy9891,

Try something like this instead of using appeds :

earliest=-1d@d latest=@d host=NETWEBA* sourcetype="WinEventLog:Application"  "ErrorGUID" ( ApplicationSource="/api/tcrm*" OR ApplicationSource="/TalentAnalyzer*" ApplicationSource="/jcm*")
| eval App= case(match(ApplicationSource,"/api/tcrm*"),"Api.TCRM", match(ApplicationSource,"/jcm*"),"JCM",match(ApplicationSource,"/TalentAnalyzer*"),"TalentAnalyzer")
| timechart span=1h count by App

Let me know if that helps.

Cheers,
David

[lsy9891]

I tried that query and it returns 0 events?

[lsy9891]

There is a missing OR between app source of jcm and talentanalyzer

[lsy9891]

Why does talentanalyzer appear as Null in the graph?

[lsy9891]

I realized it's because it returns 0 events for the time frame. Can it still display as "Talentanalyzer" even if it returns 0 events.

[DavidHourani]

Hey hey,

Glad it worked out for you, have you tried fillnull to add zeros to null values ? That should help fix your remaining issue.

Cheers,
David