Hello,
I have 2 timecharts that are working independently, can you help to merge both to one query (as overylay), the modified query should show timecharts based on 2 different source types and different criteria's.
Query 1 : index=index1 sourcetype="sourcetype1" "SearchString1"|timechart count span=1h
Query 2 : index=index1 sourcetype=sourcetype2 "SearchString2"=* | timechart count by "SearchString2"
Hi somesoni2,
thanks for your input, I tried and it seems its not considering SearchString1 values, could you help me understand in detail as i could try/tweak it.
Thanks
Mathan J
Give this a try
index=index1 (sourcetype="sourcetype1" "SearchString1") OR (sourcetype=sourcetype2 "SearchString2"=*)
| eval "SearchString2"=if(sourcetype="sourcetype1","count",'SearchString2')
| timechart count by "SearchString2"