How to create a chart from output of index and dataset?

[AmitSampat]

All,

I have an index with some fields like appId and responsetime. I also have a dataset where the appId is same, but in this file I have a propername linked with the appId

So as example
INDEX OUTPUT
appId, responsetime
202, 1200

OUTPUT file
appId, serviceName
202, serviceA

I am looking for a syntax where I can have the output:
serviceA, responseTime
202, 1200

And on top of this, I want to create a chart out of this.

I was playing around with a join query and was able to create a table

index=xx | dedup appId | eval duration = RT - FT | join type=inner appId
[|inputlookup tmpfile.csv | rename serviceA as URL]
| table appId serviceA responsetime
|where appId = appId

BUT, I can not create charts with avg(responseTime).

Can someone help?

Thanks.

Amit

[nadlurinadluri]

You dont need to use join here when the data is in lookup file and for charts you can use stats command , you can try something like below - 

$FirstQuery which gives appId and reponseTime as output$
| lookup tmpfile.csv appId AS appId output serviceA
| stats avg(responseTime) AS responseTime by appId,serviceA

[AmitSampat]

Thank for the response.

I tried, but this is not working. Also I need to remove the dedup, otherwise it will take only one event.
The thing is de index output results in many appId's with some responsetime. I need to make this into a chart, linked with the servicename (which is not there in the index output).

Any tips how to proceed?

Thanks