I replied to your previous message on this topic.  https://community.splunk.com/t5/Splunk-Search/Search-strings-and-conditions-together/m-p/529223/highlight/false#M149434 ... View more

I think I understand why that failed.  Try this alternative. index=myindex sourcetype=mySourceTYpe | eval error = if(level="ERROR" OR searchmatch("Failed") OR searchmatch("Exception") OR searchmatch("Fatal"), 1, 0) | timechart count as total_logs count(eval(level="INFO")) as total_info count(eval(level="WARN")) as total_warn sum(error) as total_error span=1h ... View more

thank you a lot . 1) As i have 2 applications Source types, do i need to make separate graphs? Can i do something by which i can identify those error/Info/warn belongs to which Job ? 2) Also If i need to do to add some texts like error, failed, exceptions to the ERROR bucket in the above example? ... View more