I'm not sure how to club the actual log files since they will be picked from separate source paths and be considered as individual files, but if you want to query on all the log files, try OR index=idx1 source="yourpath1\source1" OR source="yourpath2\source2" OR source="yourpath3\source3" and if they are different files under same root folder, you can use wildcard too: source= "yourpath\source*" Let me know if this helps ... View more

The search I posted should be good to go with a pie chart. When you click on the pieces of that pie chart, it shows you which components were successful (and which weren't). ... View more

pls consider the following search source="all_option_to_tmp" | rex field=_raw "cmd_name=(?[^]+))" | transaction cmd_name startswith="Start_time" endswith="end_time" |timechart count by duration ... View more