For the following search sourcetype=abc_access OR sourcetype=xyz_soa_access host="*12546abc*p*" source="*access_log*" "ABCProcess" | stats count | RENAME count as ABCOrders| appendcols [search source="*access*log*" ReceiptService host="ghjsms" | stats count | RENAME count as ReceiptService] | appendcols [search sourcetype=abc_access OR sourcetype=xyz_soa_access host="*12546abc*p*" source="*access_log*" "ProcessOrders" | stats count | RENAME count as ProcessOrders] I would like to know 1. How to count all the count results on multiple searches? 2. How to present it in a line graph if it has to be shown on hourly? ... View more