help to timechart after an append command

[jip31]

hello

I use a search with the structure like below in order to timechart events from 2 different search

As you can see, I need to perc90 the events before doing a timechart

My question concerns the timechart 

Is there a way to timechart the events without using an avg function?

index=toto
| search abc <=1000
| stats perc90(abc) as "titi" by _time 
| append 
    [ search index=toto 
    | search abc >= 1000 
    | stats perc90(abc) as "tutu" by _time ] 
| timechart span=1m avg("titi") as "titi", avg("tutu") as "tutu"

Thanks

[gcusello · Accepted solution]

Hi @jip31,

did you tried something like this?

index=toto
| eval kind=if(abc<=1000,"titi","tutu")
| timechart perc90(abc) BY kind 

Ciao.

Giuseppe

[jip31]

Hi Gcusello, good idea thanks

[gcusello]

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉