I need a time chart from multiple source --
First source search :
host=abcdefgh source="Test.log" index=app_ops_prod SessionID="*"
Second Source search :
host=abcdefgh source="Test.log" index=app_ops_prod "error.timeout"
Third Source search :
host=abcdefgh source="Test.log" index=app_ops_prod "error.badurl"
My SessionID is a field, but other two strings might be present in the raw log. In short, for one request a log line is generated which will always have a SessionID, but few log lines may contain error. I want a timechart that will show number of request (i.e. count of SessionID) and the errors in all the request.
Plz try that.
index=appopsprod host=abcdefgh source="Test.log" SessionID="*" | timechart span=1m count(SessionID) | appendcols [search index=appopsprod host=abcdefgh source="Test.log" ("error.badurl" OR "error.timeout") | timechart span=1m count]
Also on the chart, you can add the chart overlay to better illustrate your data.
Not sure about this. It is not giving expected results. But, the one answer posted below seems to work fine
Try like this
host=abcdefgh source="Test.log" index=app_ops_prod (SessionID="*" OR "error.timeout" OR "error.badurl" ) | eval TimeoutError=if(searchmatch("error.timeout"),1,0) | eval BadUrlError=if(searchmatch("error.badurl"),1,0) | timechart count(SessionID) as NoOfRequests sum(TimeoutError) as TimeoutError sum(BadUrlError) as BadUrlError