timechart overlay

[c799651]

Hi

I have this search which graphs calls to phone numbers

index=myindex sourcetype=mysource Number IN (5551,5555,55557,3249,2850,3353,6150)
| timechart span=1h count by Number

I have a different search that returns bad calls.

index=myindex sourcetype=mysource "1 4 3 1"
| stats count as BAD

I want to overlay the count of bad calls from search 2 on the timechart from search one

[c799651]

Thanks. The data is call records for phones calls.   Every call record has a  phone number  (which is a defined field) so in the first query  (using the IN) I'm looking for a few phone numbers that belong to a customer. The records contain details of call results. A call which has been blocked will have a string "1 4 3 1" (not a defined field).  So I want to show a graph of the  calls to the phone numbers (which the first query above does) and then overlay the blocked calls.  Only a small number of calls are blocked (contain "1 4 3 1") .

[ITWhisperer]

Your overlay should have the same x-axis as your main data, in your case this appears to be _time from the first query but that doesn't appear in your second query, so you would need to fix that. It isn't clear whether "1 4 3 1" is also a Number or a different field, nor whether BAD numbers are mutually exclusive with Numbers in your IN list. Please can you describe your data and what you are trying to achieve a bit more clearly