Ive changed my query round and got it working as the issue was to do with the multiple if statements i had and also how it worked with the multiple indexes. I changed it to the below and now working perfectly
(index=search1) OR (index=search2)
| eval errors=if(index="search2",1,if(ErrorDescription="null" AND index="search1", 2, 3))
| timechart span=1d count by errors | rename 1 as time_out, 2 as success, 3 as failure
I HAD to use quotations on the indexes aswell otherwise the answers were not correct for the eval but now gives me 3 columns with the data i need
... View more