@a238574, For plotting two series on chart, you should also have aggregation field name as first first column i.e.
sno stats1 stats2
sno1 23 5
sno2 45 7
sno3 19 2
So you would ideally need to retain aggregation field name in your final result or need to create one. Please share your current query if you need us to look and correct the same. In order to create a new field one of the ways would be to use streamstats
<yourCurrentSearch>
| streamstats count as sno
| eval sno="sno".sno
| table sno <yourFirstStatsField> <yourSecondStatsField>
Following is the run anywhere search based on sample data provided.
| makeresults
| eval data="23,5;45,7;19,2"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval stats1=mvindex(data,0),stats2=mvindex(data,1)
| fields - _time data
| streamstats count as sno
| eval sno="sno".sno
| table sno stats1 stats2
Please try out and confirm!
... View more