I have 2 queries which is having sub search for input look up in each. Query 1 This query outputs the timechart for for CPU1. It will count each processes listed in the CPU1 field of the test.csv. index=custom | eval SEP=split(_raw,"|"), eval CPU1=trim(mvindex(SEP,1)) | bin _time span=1m | stats count(CPU1) as CPU1_COUNT by _time CPU1 | search [ | input lookup test.csv | fields CPU1 | fillnull value = 0 | format ] Query 2 This query outputs the timechart for for CPU2. It will count each processes listed in the CPU2 field of the test.csv. index=custom | eval SEP=split(_raw,"|"), eval CPU2=trim(mvindex(SEP,1)) | bin _time span=1m | stats count(CPU2) as CPU2_COUNT by _time CPU2 | search [ | input lookup test.csv | fields CPU2 | fillnull value = 0 | format ] test.csv (sample) CPU1 CPU2 CPU3 process_a process_b process_c process_d process_e process_f process_g process_i process_h What I want is to display the CPU1 and CPU2 time chart in one chart . Any advice on that will be a great help. Thanks
... View more