How to create a time chart with data from 3 sourcetypes?

[raindrop18]

I want to combine my search results to one time chart. I have tried this but did give me result only from the first source.

index="login" sourcetype="success" | timechart count | appendcols [search index="login" sourcetype="Failed" | timechart count] appendcols [search index="login" sourcetype="no-account" | timechart count]

[srioux · Accepted solution]

Try using:

index="login" sourcetype="success" OR sourcetype="Failed" OR sourcetype="no-account" | timechart count by sourcetype

This'll create your initial search with all results, but your timechart will be a count split by sourcetype values.

[raindrop18]

thanks you both, works as expected.

[martin_mueller]

Or, for a massive performance boost, try this under Splunk 6+:

| tstats count where index="login" AND (sourcetype="success" OR sourcetype="Failed" OR sourcetype="no-account") by sourcetype _time span=auto | timechart count by sourcetype