@yeahnah and just out of curiosity, is it possible to create a Multi-Series Line Chart using 2 different queries that works by themselves? For example: 1 line: index="something" source="*-value*" ("random value 1" OR "*random value 2*")
| bin span=1d _time
| stats count(eval(match(_raw, "random value 1"))) as value_1,
count(eval(match(_raw, "random value 2"))) as value_2
by _time source
| where value_1 > 0 AND value_2 > 0
| timechart span=1d dc(source) as unique_sources 2nd line chart: index="something" source="*-value*" ("random value 1" OR "*random value 3*" OR "*random value 4*" OR "*random value 5*")
| bin span=1d _time
| stats count(eval(match(_raw, "random value 1"))) as value_1,
count(eval(match(_raw, "random value 3"))) as value_3,
count(eval(match(_raw, "random value 4"))) as value_4,
count(eval(match(_raw, "random value 5"))) as value_5,
by _time source
| where value_1 > 0 AND (value_3 > 0 OR value_4 OR value_5)
| timechart span=1d dc(source) as unique_sources It looks like it is easier just to split into to 2 billboards, but might be be better to have them in the same one (in case it is possible)
... View more