I have a requirement wherein I have to display 3 different series in a single chart. I am using an append query to fetch all the results and manipulating the search job in my dashboard.xml. I also have a dropdown at the top to select time ranges. Based on the time ranges selected, my timechart's span should also vary ex. for last 60 minutes, the span should be 5 minutes and so on. When I pass the span value dynamically, I am getting an error saying "Invalid Option". Please tell me how this can be done.
In that case you can hack yourself to dynamic spans like this:
index=_internal | timechart count [stats count | addinfo | eval range = info_max_time - info_min_time | eval span = "span=".case(range < 4000, "5m", range < 90000, "1h", 1=1, "12h") | return $span]
The subsearch probably is best put into a macro.