multiple search results on singlechart

[ChhayaV]

hi,

these are my searches

index=tm_idx host="audit" | timechart count by Process usenull="f"

index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"

I want to show result of these searches on a single chart

[HiroshiSatoh · Accepted solution]

I think it is good if you use the append.

index=tm_idx host="audit" | timechart count by Process usenull="f"|append [search index=tm_idx host="audit" ID=144 | timechart count by ID usenull="f"]

[zeroactive]

Using "append" will give you a two charts side by side with the timeframe repeated. If you use "appendcols" instead, it will give you the results of both charts within one timeframe (overlapping instead of side by side).