timeseries using an OR text search

[chadwell]

So I have the following search and I want to create a dashboard with separate columns for "Hits" and "Misses".

Seems this should be pretty straightforward but I am lost joins, stats, evals etc:

cf_org_name="ABB" cf_space_name="qa" cf_app_name=*qa-my-app* index=ocf_* "CACHE Hit" OR "CACHE Miss" | timechart span=1d count by type

How can I convert this to a chart with 2 columns which show Hits and Misses per day?

Thanks

[richgalloway · Accepted solution]

Set the type field based on which string was found in the event.

cf_org_name="ABB" cf_space_name="qa" cf_app_name=*qa-my-app* index=ocf_* "CACHE Hit" OR "CACHE Miss" 
| eval type=if(searchmatch("CACHE Hit"),"Hit","Miss")
| timechart span=1d count by type