How to count all the count results on multiple searches and display it in a line graph if it has to be shown hourly?

[sgarine8925]

For the following search

sourcetype=abc_access OR sourcetype=xyz_soa_access host="*12546abc*p*" source="*access_log*" "ABCProcess" | stats count | RENAME count as ABCOrders| appendcols [search
source="*access*log*" ReceiptService host="ghjsms" | stats count | RENAME count as ReceiptService] | appendcols [search
sourcetype=abc_access OR sourcetype=xyz_soa_access host="*12546abc*p*" source="*access_log*" "ProcessOrders" | stats count | RENAME count as ProcessOrders]

I would like to know
1. How to count all the count results on multiple searches? 2. How to present it in a line graph if it has to be shown on hourly?

[sundareshr · Accepted solution]

Here's one way. You may not need multiple searches. You should be able to combine all three into one like this.. Give it a try

sourcetype=abc_access OR sourcetype=xyz_soa_access host="*12546abc*p*" OR host="ghjsms" OR host="*12546abc*p*" source="*access_log*" "ABCProcess"  OR ReceiptService  OR "ProcessOrders" | rex "(?<category>ABCProcess|ReceiptService|ProcessOrders") | timechart span=1h count by category