merge timechart column

[darksky21]

Hi i am using timechart count by source. It gave me a table:

_time cat dog  car
23/3   2   2    3
24/5   5   4    3

is there anyway to merge cat and dog into a single column like animal?

_time  animal  car
23/3      4     3
24/5      9     3

Thanks in advance

[ShaneNewman]

Sure thing, you will have to evaluate a new field and use the chart command instead. If you want it by day you will need to add the bucket command. Something of this effect:

your search | eval animal=(cat+dog) | bucket span=1d _time | chart sum(animal) as animal, sum(car) as car by _time

[lguinn2 · Accepted solution]

Yes!

yoursearchhere
| eval source=if(source=="cat" OR source=="dog","animal",source)
| timechart count by source

[darksky21]

thanks it works great