hello all,
i have 2 searches each with its own source, and i need to time chart that over 24 hrs in single chart? i cant figure out how to do that...
here are the searches: Search1: host="SOURCE1" PROCESSFLAG=SUCCESS| timechart span="1h" count by PROCESSFLAG
Search2: host="SOURCE2" NOT ORDER_STATUS ORDER_STATUS="Entered" OR ORDER_STATUS="Booked" | timechart span="1h" count by ORDER_STATUS
Thanks Ashish
I think the following should give you what you want.
host="SOURCE1" PROCESSFLAG=SUCCESS
| timechart span="1h" count by PROCESSFLAG
| join _time
[search host="SOURCE2" NOT ORDER_STATUS ORDER_STATUS="Entered" OR ORDER_STATUS="Booked"
| timechart span="1h" count by ORDER_STATUS
]
Let me know if that works out.
I think the following should give you what you want.
host="SOURCE1" PROCESSFLAG=SUCCESS
| timechart span="1h" count by PROCESSFLAG
| join _time
[search host="SOURCE2" NOT ORDER_STATUS ORDER_STATUS="Entered" OR ORDER_STATUS="Booked"
| timechart span="1h" count by ORDER_STATUS
]
Let me know if that works out.
Wow this is cool..
thanks