Hi Guiseppe, thanks for the reply. yes they are the same search with the exception of the second search have updated code. the goal is to merge the data to show the difference in execution time. I have the tokens $alertNameTok$ and $alertNameTok1$. Here's what I have for the code.
index=_internal source="*scheduler.log" app="hdo_monitoring" status="success" $alertNameTok$ $alertNameTok1$ earliest=$timetok.earliest$ latest=$timetok.latest$
| timechart span=10m first(run_time) first(result_count) by savedsearch_name
attached: snapshot - no results
... View more