Comments

3 comments

  • Official comment
    Avatar
    Graham Watts

    Hey Soumya,

    You can plot both series in one table like this:


    (_sourceCategory=app1 or  _sourceCategory=app2) "HTTP/1.1 500"
    | count by _sourceCategory
    | sort _count

    You could also plot these over time like this:


    (_sourceCategory=app1 or  _sourceCategory=app2) "HTTP/1.1 500"
    | timeslice 15m
    | count by _sourceCategory, _timeslice
    | transpose row _timeslice column _sourceCategory

    Comment actions Permalink
  • Avatar
    David Wynn

    Kelly,

    There's no way to combine two searches into one graph, but you can combine multiple aggregates in one query by comma separating them instead of pipe separating them. Then both sets of values will be available int he same panel.

    0
    Comment actions Permalink
  • Avatar
    Soumya Mandi

     I am trying to solve the same problem.

    I have two aggregate counts:
    1) _sourceCategory=app1 "HTTP/1.1 500" | count
    2) _sourceCategory=app2 "HTTP/1.1 500" | count

    How do I combine them in one table view? I didn't understand the "comma separating them" part and how to use it.

    0
    Comment actions Permalink

Please sign in to leave a comment.