I have two CSV files
File 1=bbOrCellOffline . index=betadb
Contents look like this
File 2 Beta.csv . index=version
What I'm looking to do is have a time chart that counts all events in the bbOrCellOffline file (easy enough), but then overlay the events from the Beta.csv file. (getting stuck here)
My (non working) query looks like this
(index=betadb OR index=allmsos) (source=*bbOrCellOffline* OR source=*Beta.csv*) |timechart count as Count count(eval(source="*Beta.csv*")) as "Version Count"
(index=betadb OR index=allmsos) (source=*bbOrCellOffline* OR source=*Beta.csv*)
| eval theSource=if(index=="betadb","bbOrCellOffline","Beta.csv")
| timechart count by theSource
If you don't want the Total column, you can simply leave off the addtotals command. Once you have the chart that you want, use the formatting commands to decide which line will be the overlay...
View solution in original post