How to display two timecharts on one chart

[jerrysplunk88]

trying to display two timecharts together, to make it easy to spot the time when no response received for the request sent.

the search looks like this

index="production   "sending request"  | dedup requestId
| timechart span=1h sum(count) as count1

| append [search index="production"  "response received"
| dedup requestId | timechart span=1h sum(count) as count2]

this is not showing the two columns (count1 and count2) I was hoping to see,  appendcol doesn't work either .

I tried just using just count

index="production   "sending request"  | dedup requestId
| timechart span=1h count

| append [search index="production"  "response received"
| dedup requestId | timechart span=1h count]

this shows only one column called count.

Any help is greatly appreciated!

[kamlesh_vaghela]

@jerrysplunk88 

Can you please try this?

index="production" ("sending request" OR "response received")
| dedup requestId
| timechart sum(eval(if(match(_raw,"sending request"),1,0))) as count1, sum(eval(if(match(_raw,"response received"),1,0))) as count2

My Sample Search :

| makeresults | eval raw="aaaaaa sending request bbbbb|cccccc response received dddd|aaaaaa sending request bbbbb", raw=split(raw,"|")| mvexpand raw | rename raw as _raw
|eval requestId=1 | accum requestId
| rename comment as "Upto Now is sample data only" 
| dedup requestId
| timechart sum(eval(if(match(_raw,"sending request"),1,0))) as count1, sum(eval(if(match(_raw,"response received"),1,0))) as count2

 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[jerrysplunk88]

Thanks for the solution, I know it could work but in my case, the request and response have the same request ID so putting them in one search and dedup will get the wrong count.

Is there any way to use two searches and combine the results?

[kamlesh_vaghela]

@jerrysplunk88 

Can you please try this?

YOUR_SEARCH
| eval sr1=if(match(_raw,"sending request"),requestId,null()), sr2=if(match(_raw,"response received"),requestId,null())
| timechart dc(sr1) as count1, dc(sr2) as count2

My Sample Search :

| makeresults | eval raw="aaaaaa sending request bbbbb&&cccccc response received dddd|aaaaaa sending request bbbbb", raw=split(raw,"|") | mvexpand raw 
|eval requestId=1 | accum requestId | eval raw=split(raw,"&&") | mvexpand raw  | rename raw as _raw
| rename comment as "Upto Now is sample data only" 
| eval sr1=if(match(_raw,"sending request"),requestId,null()), sr2=if(match(_raw,"response received"),requestId,null())
| timechart dc(sr1) as count1, dc(sr2) as count2

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.