How to build a timechart from a combined search

[brajaram]

I have two different sources, each with information related to one another. The first source has, as part of the file, every successful page hit. The second source, has, as part of the file, every error report.

index= sourcetype=< st> source= < hit log > < some further conditions >
| stats count as total_hits 
| appendcols [search index= sourcetype=< st> source= < error log > < some otherfurther conditions > 
| stats count as total_errors ]

If I do a search like this, I successfully get the count of crashes, count of successes, and can do an eval FailureRate= total_hits/total_errors

However, I want to further do a timechart to see the failure rate over time, and this is where I am stuck. How would I propagate time throughout this process to build a timechart of a single value?

[somesoni2 · Accepted solution]

Try like this (I'm assuming sourcetype is the only distinction between two sources. If sourcetype is same and source is different, update if condition with that)
Updated

(index= sourcetype=< st> source= < hit log > < some further conditions >) OR ( index= sourcetype=< st> source= < error log > < some otherfurther conditions >)
| eval type=if(source="< hit log > ","total_hits","total_errors")
| timechart count by type | eval FailureRate= total_hits/total_errors

[brajaram]

Worked great, thanks! A different approach than I had, and it worked to keep the time field all the way down.