Using savedsearch and timechart, I'm getting NULL where I'd expect the values of "myfield"
Base search (@m to -1h@h)
index=myindex myfield=*FOO* | timechart span=1h count by myfield
And aggregating searches like
| savedsearch mysavedsearch1 | timechart span=1d count by myfield
Aggregating search has time stamps in correct grouping, but the other column is labeled NULL when it should be values like myfield-foo, foo-myfield, etc..
Once you fire your first query, the columns available are _time and value of myfield (not the column with name myfield). So when you're using your second search, it'll return NULL as there is no column with name myfield. This is how you should implement this
Base search (@m to -1h@h)
index=myindex myfield=*FOO* | bucket span=1h _time | stats count by _time myfield
And aggregating searches like
| savedsearch mysavedsearch1 | timechart span=1d sum(count) by myfield
Once you fire your first query, the columns available are _time and value of myfield (not the column with name myfield). So when you're using your second search, it'll return NULL as there is no column with name myfield. This is how you should implement this
Base search (@m to -1h@h)
index=myindex myfield=*FOO* | bucket span=1h _time | stats count by _time myfield
And aggregating searches like
| savedsearch mysavedsearch1 | timechart span=1d sum(count) by myfield