How to combine multiple searches into 1 related table/graph?

[lordhans]

I have two searches something like this:

"ns=my_project" message="*RESPONSE_CODE=200*" OR "*RESPONSE_CODE=400*" METHOD=API1 add|top RESPONSE_CODE
"ns=my_project" message="*RESPONSE_CODE=200*" OR "*RESPONSE_CODE=400*" METHOD=API2 something_else|top RESPONSE_CODE

I want to combine them into one graph/table that will look something like this:

Any help or ideas are greatly appreciated!
Thanks.

[woodcock]

Try this:

index=YourIndexHere sourcetype=YourSourcetypeHere "ns=my_project" message="*RESPONSE_CODE=200*" OR "*RESPONSE_CODE=400*" ((METHOD="API1" AND "add") OR (METHOD="API2" AND "something_else")
| stats count(eval(searchmatch(message="*RESPONSE_CODE=200*"))) AS "Response 200" count(eval(searchmatch(message="*RESPONSE_CODE=400*"))) AS "Response 400" BYMETHOD

[DalJeanis]

start with this...

index=foo "ns=my_project" 
(message="*RESPONSE_CODE=200*" OR message="*RESPONSE_CODE=400*")
((METHOD="API1" and "add") OR (METHOD="API2" and "something_else"))
| stats count as eventcount by METHOD RESPONSE_CODE
| chart sum(eventcount) by METHOD RESPONSE_CODE

The above code has not used the top command to limit the responses, but if you only have 2 response codes, then top is redundant.

Here's a run-anywhere sample to show how it works...

| makeresults | eval METHOD="API1 API2 API3" | makemv METHOD | mvexpand METHOD
| eval RESPONSE_CODE="200 400" | makemv RESPONSE_CODE| mvexpand RESPONSE_CODE
| eval rand=random()%155
| rename COMMENT as "The above just generates test data."

| stats sum(rand) as eventcount by METHOD RESPONSE_CODE
| chart sum(eventcount) by METHOD RESPONSE_CODE