We are having trouble regarding a query in which we need to display multiple metric_labels of a host in a single timechart. the query is as follows:
index="xyz" source_host="host1" OR "host2" metric_label="metric_label1" OR "metric_label2" OR "metric_label3 " OR "metric_label4" |dedup source_host _time | append [ search index="abc" source="source.csv" ] | timechart span=12h count(metric_value) as metric_value count(number) as "No of tickets"
We need to pull the result of two searches in a single timechart. Urgently required inputs from you guys. Thanks a lot!
... View more