How to generate a timechart from multiple data sources?

[ataunk]

I need a time chart from multiple source --

First source search : host=abcdefgh source="Test.log" index=app_ops_prod SessionID="*"
Second Source search : host=abcdefgh source="Test.log" index=app_ops_prod "error.timeout"
Third Source search : host=abcdefgh source="Test.log" index=app_ops_prod "error.badurl"

My SessionID is a field, but other two strings might be present in the raw log. In short, for one request a log line is generated which will always have a SessionID, but few log lines may contain error. I want a timechart that will show number of request (i.e. count of SessionID) and the errors in all the request.

[somesoni2 · Accepted solution]

Try like this

host=abcdefgh source="Test.log" index=app_ops_prod (SessionID="*" OR "error.timeout" OR  "error.badurl" )
| eval TimeoutError=if(searchmatch("error.timeout"),1,0) | eval BadUrlError=if(searchmatch("error.badurl"),1,0) 
| timechart count(SessionID) as NoOfRequests sum(TimeoutError) as TimeoutError sum(BadUrlError) as BadUrlError

[ataunk]

This is working as expected.

[arcdevil]

Plz try that.

index=app_ops_prod host=abcdefgh source="Test.log" SessionID="*" | timechart span=1m count(SessionID) | appendcols [search index=app_ops_prod host=abcdefgh source="Test.log" ("error.badurl" OR "error.timeout") | timechart span=1m count]

Also on the chart, you can add the chart overlay to better illustrate your data.

[ataunk]

Not sure about this. It is not giving expected results. But, the one answer posted below seems to work fine

[arcdevil]

No problem 🙂 I'm glad to hear that your problem has been solved.