Merging two chart together

[carrotball]

Hi,

I'm currently have 2 charts, one is the number of sms sent during office hour, the other is after office hour. is there any way i can merge the 2 search queries as one?

sourcetype="CAS-v3" sender!="CHI" sender!="PNSMS" dept=TSID recipient="HEAT*" | where date_hour>8 and date_hour<19 | timechart span="month" count by recipient

sourcetype="CAS-v3" sender!="CHI" sender!="PNSMS" dept=TSID recipient="HEAT*" | where date_hour<8 or date_hour>19 | timechart span="month" count by recipient

[Ayn]

sourcetype="CAS-v3" sender!="CHI" sender!="PNSMS" dept=TSID recipient="HEAT*" | eval hour_type=case(date_hour>=8 AND date_hour<19,"office hours",date_hour<8 OR date_hour>=19,"outside office hours") |timechart span=1mon count by recipient,hour_type

[carrotball]

hmmmmm
thanks for the help, the second one works but cant display it by month...

wondering if i can tune it more. time to go read lol

[MuS]

I wonder if this will work, because 'timechart' can only take one 'split by' series, 'chart' can take two.

So for timechart it would be:
...| timechart span=1mon count(recipient) by hour_type

and for chart it would be:
...| chart count by recipient,hour_type

on the other hand, count(recipient) will count all events that have a recipient and not events for each recipient....

[MuS]

hmmmmm I must be doing something wrong here Ayn, but I get an 'Error in 'timechart' command: The argument 'hour_type' is invalid.' if I use your search?