How to append multiple searches in one search?

[anujs]

Hi,

I tried using the following command to append few searches in one:

index=network host=sg624* "fatal" NOT (Non-fatal) | timechart count as "Fatal Error" | appendcols [search  index=network host=sg624*  supervisor | timechart count as "Supervisor Card Fail" ]| appendcols [search  index=network host=sg624* "Node down" | timechart count as "Node Down"] | appendcols [search index=network host=sg624* ERR_DISABLE | timechart count as "Error Disabled Port" ]| appendcols [search index=network host=sg624* "Duplicate IP" OR IP-4-DUPADDR   | timechart count as "Duplicate IP" ] | appendcols [search index=network host=sg624* "MAC Flapping" | timechart count as "MAC Flap" ] | appendcols [search index=network host=sg624*  "Traceback" | timechart count as "Traceback Error" ] | appendcols [search index=network host=sg624* "NBRCHANGE" | timechart count as "Neighborship Change"]|eval threshold=0

But I cannot see the timestamp on the X-Axis.
When we have values for two of the above append searches we are able to see the timestamp. But if only one search is having value, the timestamp is not displayed.

Kindly suggest how can the timestamp be displayed.

Thank You.

[sundareshr]

See if this gives you better results

index=network host=sg624* ("fatal" NOT (Non-fatal)) OR ("supervisor" OR "Node down" OR ERR_DISABLE OR "Duplicate IP" OR IP-4-DUPADDR OR "MAC Flapping" OR "Traceback" OR "NBRCHANGE") 
| timechart count(match(_raw, "fatal")) as "Fatal Error" count(match(_raw, "supervisor")) as "Supervisor Card Fail" count(match(_raw, "Node Down")) as "Node Down" count(match(_raw, "ERR_DISABLE")) as "Error Disabled Port" count(match(_raw, "Duplicate IP") OR match(_raw, "IP-4-DUPADDR")) "Duplicate IP" count(match(_raw, "MAC Flapping")) as "MAC Flap" match(_raw, "Traceback")) as "Traceback Error" count(match(_raw, "NBRCHANGE")) as "Neighborship Change" 
| eval threshold=0

[anujs]

index=network host=sg624* ("fatal" NOT (Non-fatal)) OR ("supervisor" OR "Node down" OR ERR_DISABLE OR "Duplicate IP" OR IP-4-DUPADDR OR "MAC Flapping" OR "Traceback" OR "NBRCHANGE") | timechart count(match(_raw, "fatal")) as "Fatal Error" count(match(_raw, "supervisor")) as "Supervisor Card Fail" count(match(_raw, "Node Down")) as "Node Down" count(match(_raw, "ERR_DISABLE")) as "Error Disabled Port" count(match(_raw, ("Duplicate IP") OR match(_raw, "IP-4-DUPADDR"))) as "Duplicate IP" count(match(_raw, "MAC Flapping")) as "MAC Flap" count(match(_raw,"Traceback")) as "Traceback Error" count(match(_raw, "NBRCHANGE")) as "Neighborship Change"| eval threshold=0

This gives all values 0 (Blank Graph). But we have some Traceback Values.

[anujs]

The above one did not work. Any new suggestions?