Hi All,
I would like to combine below two searches in one timechart stacked with x axis showing date and total records under each column stack
Search 1: ( Display batch runtime(in hours) by batch code over a day)
index=batch batch_cd="A1" OR batch_cd="A2" OR batch_cd="A3" OR batch_cd="A4" | timechart span=1d eval(sum(total_time)/60) as hours by batch_cd usenull=f useother=f limit=0
Search 2: ( Display total records processed by batch code over a day)
index=batch batch_cd="B1" OR batch_cd="B2" | bucket _time span=1d | stats sum(total_records) as tot_rec by batch_cd
1.Combine above two searches in a single query
2.Display search results in stacked mode
3.Display total_records below x axis along with time chart date
4.Show runtime hours as running labels top of each stack bar
5.Show legends grouped logically
... View more