How to timechart several eval commands in one search?

[naty]

Hi,

i am doing a search with append and i am trying to optimize it.
this is my search:

index=myind source=mysrc POOL_ID=id  | eval TOTAL_RATE=(READ_XFER_RATE + WRITE_XFER_RATE)/1024 | eval ReportKey="Total Transfer" | append [search index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=READ_XFER_RATE/1024 | eval ReportKey="Read Transfer" | append [search index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=WRITE_XFER_RATE/1024 | eval ReportKey="Write Transfer"]] | timechart span=1m max(TOTAL_RATE) by ReportKey

my problem is with all the appends, it's not very good.
i already get all the data i need in the first search, why do it again? 😛

so i want to do something like this:

index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=(READ_XFER_RATE + WRITE_XFER_RATE)/1024 | eval TOTAL_READ=READ_XFER_RATE/1024 | eval TOTAL_WRITE=WRITE_XFER_RATE/1024

the next thing i want is to pair each eval with a name, like this:

eval TOTAL_RATE=(READ_XFER_RATE + WRITE_XFER_RATE)/1024 "Total Transfer" | eval TOTAL_READ=READ_XFER_RATE/1024 "Read Transfer" | eval TOTAL_WRITE=WRITE_XFER_RATE "Write Transfer"

and in the end do a timechart for each eval by its label.

so in the end, the search should be in this mindset:

index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=(READ_RESPONSE_RATE + WRITE_RESPONSE_RATE)/2/1000 | eval TOTAL_READ=READ_RESPONSE_RATE/1000 | eval TOTAL_WRITE=WRITE_RESPONSE_RATE | table _time,TOTAL_RATE,TOTAL_WRITE,TOTAL_READ | 

is it possible?
if so, how to make the magic happen?

Thank you!

[somesoni2]

You were almost there. Try like this

index=myind source=mysrc POOL_ID=id | eval TOTAL_RATE=(READ_XFER_RATE + WRITE_XFER_RATE)/1024 | eval TOTAL_READ=READ_XFER_RATE/1024 | eval TOTAL_WRITE=WRITE_XFER_RATE/1024
| timechart span=1m max(TOTAL_RATE) as "Total Transfer" max(TOTAL_READ) as  "Read Transfer"  max(TOTAL_WRITE) as  "Write Transfer"