Hi @onthakur, you have to categorize the events: if LOG1, LOG2 and LOG3 have different sourcetypes (or something else to recognize them), the Event is a field that you already extracted, Correl...
See more...
Hi @onthakur, you have to categorize the events: if LOG1, LOG2 and LOG3 have different sourcetypes (or something else to recognize them), the Event is a field that you already extracted, CorrelationID is a common key between the three logs, success is an action when you have the message "record completed", error is an action when you have the message "Couldn't save the SubscribersSettings record in DB", remember that you cannot have more columns in timechart, so you must use stats. you could create a search like the following: index=your_index sourcetype IN (LOG1, LOG2, LOG3)
| bin span=1h _time
| stats
values(Event) AS Event
count AS Total_Count
count(eval(searchmatch("record completed") AS "success"
count(eval(searchmatch("Couldn't save the SubscribersSettings record in DB") AS "Error"
BY _time CorrelationID Adapt the search to your conditions. Ciao. Giuseppe