"Count Over" Statement not working

[athorat]

Hi ,
I am using two queries and then want to use the status from the first query and the DP_Time from the second query to display a chart.

I can get the count of both but cant use "by status" or "count over status" statement.

index="np_dpa" "*-api-monitor" PROXYNAME=mpgw_SMARTtrek* EventType="[request]" OR EventType="[error]" | eval status=case(EventType="[error]","Fail",EventType="[request]","Success")  

| append [search index=np_dpa PROXYNAME=mpgw_SMARTtrekTelematicsAPI latency| 
  eval Back_Time = abs(bs_conn_attempt-res_hdr_rec)/1000 | eval Req_Time = abs(req_transmitted-req_hdr_rd)/1000 | eval Resp_Time = abs(res_hdr_rec-res_transmitted)/1000 | eval Total_Time = abs(res_transmitted-req_hdr_rd)/1000 |eval DP_Time=abs(Req_Time  + Resp_Time)]

 |chart avg(DP_Time) count over status

[somesoni2]

How are both the result set related? Both status and DP_Time appear to be available in different events, so unless you've a common field correlating them, the graph you're looking is not possible.

[athorat]

@somesoni2 We have TID and Proxyname common between both the queries

[masonmorales · Accepted solution]

Although status exists in both sets of results, DP_Time does not. So, when you do a stats function(field) by someotherfield, if someotherfield does not exist in both sets of results, you will get zero results.

[athorat]

instead of append can I join it some how?