I have this query: index=betas host="*433*" level=ERROR (source="*RequestUpg*" class="*RequestUpgEndPoint*") OR (source="*DisplayUpgPassengerItineraries*" class="*DisplayUpgPassengerItinerariesEndPoint*") OR (source="*ApiUpg*" class="*GetCustomersService*" OR class="*ItineraryService*" OR class="*RequestUpgService*" OR class="*GetCustomersController*" OR class="*AuthenticationServiceFilter*") | timechart span=1d count by class It does exactly what I want except it produces several charts: I want it to produce one chart with this exact labels altogether in one chart, how should I approach it? ... View more

index=betas host="*433*" description="POSTULATION_SUCCESS" OR description="POSTULATION_FAIL" | dedup pnr | bucket _time span=1d | stats count(eval(description="POSTULATION_SUCCESS")) as successes count(eval(description="POSTULATION_FAIL")) as failures by _time | eval total=failures+successes | eval ratio=successes/total | fields - total successes failures I get certain results when I add dedup pnr and certain results without it. I'm interested in having them both on the same chart. What would be a good approach for this? EDIT: To make my point clearer This index=betas host="*433*" description="POSTULATION_SUCCESS" OR description="POSTULATION_FAIL" | dedup pnr | bucket _time span=1d | stats count(eval(description="POSTULATION_SUCCESS")) as successes count(eval(description="POSTULATION_FAIL")) as failures by _time | eval total=failures+successes | eval ratio=successes/total | fields - total successes failures produces a chart like this: And this: index=betas host="*433*" description="POSTULATION_SUCCESS" OR description="POSTULATION_FAIL" | bucket _time span=1d | stats count(eval(description="POSTULATION_SUCCESS")) as successes count(eval(description="POSTULATION_FAIL")) as failures by _time | eval total=failures+successes | eval ratio=successes/total | fields - total successes failures Note that the dedup is gone but the rest is identical produces this: I need to put this to lines in the same chart. ... View more