piechart

[avneet26]

I want to create two pie chart each based upon the value of index I am choosing. using below two queries

1. index = index1 host=.......| ...

2. index=index2 host=....|

then i want to include both of these pie charts into the same report so that I can send them as alert in the same mail. How can I do that ? tried append and multi search but didnt help.

[avneet26]

it didnt give any results. my concern is how can I generate two different pie charts using these two searches and those two pie charts should be different based on index values(one for index1 other for index2)

[ITWhisperer]

Sorry, I misunderstood, I thought you were trying to use two indexes in the same chart. The chart is a visualisation of the results of a query. I don't think there is a standard pie chart visualisation that produces multiple charts. Perhaps you should submit this as an improvement request.

[avneet26]

search index= index1
host=*
source=*logs* username
sourcetype=* | rex "user\":\"(?<user>[^\"]+)" | stats count by user] |
append [search index= index2
host=*
source=*logs* user
sourcetype=* | rex "user\":\"(?<user>[^\"]+)" | stats count by user]

this didnt work for me

[ITWhisperer]

In what way didn't it work? No result? Incorrect results? host missing?

Are these event similar, just in different indexes? Can you use:

search index=index1 OR index=index2
host=*
source=*logs* username
sourcetype=* | rex "user\":\"(?<user>[^\"]+)" | stats count by user

or 

| stats values(index) as index count by user

 or

| stats count by user index

[ITWhisperer]

Can you be a bit more specific about what you tried and why it didn't work? Append and multiple searches sound like they would normally solve the problem, so without further information, it is difficult to advise.