How to execute the search query on different source file an dynamic values for yaxis

[deepthi5]

Hi team,

I am stucked up with few search commands can some one pls help me
I am using the same search command on different source files using append cols but my problem is like this

I h ave a combo box which select Tier1,Tier 2,Tier3

source="C:\Network Analysis\tier1\rusxwalmartedc S0-0-0.csv" sourcetype="csv" |rex field=source "(?<country>.?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename tier|search tier=tier3|where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=In/1048576|bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time |eval total=Percentile/maxin*100|timechart span=1d values(total) As walmarttotal(%)|appendcols[search source="C:\Network Analysis\tier2\rdingurgao010-5-1 f0-1.csv" sourcetype="csv" |rex field=source "(?<country>.?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename tier|search tier=tier3 |where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=In/1048576|bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time |eval total=Percentile/maxin*100|timechart span=1d values(total) As gurgoantotal(%)]

Even though the first main search criteria is not fullfilled still the first search query result is displayed in every chart

this command is going bigger and bigger as i add other sites command so i changed the command using OR

source="C:\Network Analysis\tier1\rusxwalmartedc S0-0-0.csv" OR source="C:\Network Analysis\tier2\rdingurgao010-5-1 f0-1.csv sourcetype="csv" |rex field=source "(?<country>.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename tier|search tier=tier3|where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=In/1048576|bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time |eval total=Percentile/maxin*100|timechart span=1d values(total) As walmarttotal(%)

but at the last i want to come sitename as the yaxis label for different sites an example walmart total, gurgoan total%

Thanks and Regards,
Deepthi

[woodcock]

I am having great trouble understanding so this is a guess but try this:

source="C:Network Analysistier1rusxwalmartedc S0-0-0.csv" OR source="C:Network Analysistier2rdingurgao010-5-1 f0-1.csv sourcetype="csv" |rex field=source "(?<country>.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename tier|search tier=tier3|where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=In/1048576|bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by sitename _time |eval total=Percentile/maxin*100|timechart span=1d avg(total) As siteTotalPct by sitename