For the following search
sourcetype=abc_access OR sourcetype=xyz_soa_access host="*12546abc*p*" source="*access_log*" "ABCProcess" | stats count | RENAME count as ABCOrders| appendcols [search
source="*access*log*" ReceiptService host="ghjsms" | stats count | RENAME count as ReceiptService] | appendcols [search
sourcetype=abc_access OR sourcetype=xyz_soa_access host="*12546abc*p*" source="*access_log*" "ProcessOrders" | stats count | RENAME count as ProcessOrders]
I would like to know
1. How to count all the count results on multiple searches? 2. How to present it in a line graph if it has to be shown on hourly?
Here's one way. You may not need multiple searches. You should be able to combine all three into one like this.. Give it a try
sourcetype=abc_access OR sourcetype=xyz_soa_access host="*12546abc*p*" OR host="ghjsms" OR host="*12546abc*p*" source="*access_log*" "ABCProcess" OR ReceiptService OR "ProcessOrders" | rex "(?<category>ABCProcess|ReceiptService|ProcessOrders") | timechart span=1h count by category
Here's one way. You may not need multiple searches. You should be able to combine all three into one like this.. Give it a try
sourcetype=abc_access OR sourcetype=xyz_soa_access host="*12546abc*p*" OR host="ghjsms" OR host="*12546abc*p*" source="*access_log*" "ABCProcess" OR ReceiptService OR "ProcessOrders" | rex "(?<category>ABCProcess|ReceiptService|ProcessOrders") | timechart span=1h count by category