How to combine access log data from multiple sources over time in the same line graph?

[alafferty]

Greetings!

I have access logs from multiple sources that I'd like to combine into the same graph, basically to count the number of hits per minute on each source.

index=ihs source="*_access_log.*" |  timechart span=1m count(eval(source="/logdir/http-logs/source1_access_log.%Y%m%d")) AS source1, count(eval(source="/logdir/http-logs/source2_access_log.%Y%m%d")) AS source2, count(eval(source="/logdir/http-logs/source3_access_log.%Y%m%d")) AS source3, count(eval(source="/logdir/http-logs/source4_access_log.%Y%m%d")) AS source4

Basically each source has its own name and today's date. I'm not really sure how to approach it, but the above and everything else I've been trying doesn't work.

Thanks,
Aaron

[sundareshr]

Have you tried (for the given sample data)

index=ihs source="*_access_log.*" | rex field=source "(?<src>\w+\d)" |  timechart span=1m count by source

[alafferty]

 index=ihs source="*_access_log.*" |  timechart span=1m count(eval("source=/logdir/http-logs/source1_access_log.'%Y%m%d'")) AS source1, count(eval("source=/logdir/http-logs/source2_access_log.'%Y%m%d'")) AS source2, count(eval("source=/logdir/http-logs/source3_access_log.'%Y%m%d'")) AS source3, count(eval("source=/logdir/http-logs/source4_access_log.'%Y%m%d'")) AS source4

I tried that. It actually gets counts ind the source# table, but all of the counts are the same! Ugh. The search works fine when I manually specify the date of 20151119 at the end of the access log