Showing two searches in the same graph

Follow

Kelly Burdine

• July 07, 2015 16:16

I have two queries with aggregated fields. Is there a way to graph these two results in the same panel?

0

• Official comment

  

  Graham Watts

  • August 30, 2019 00:01

  Hey Soumya,
  
  You can plot both series in one table like this:

  
  (_sourceCategory=app1 or   _sourceCategory=app2) "HTTP/1.1 500" 
  | count by _sourceCategory
  | sort _count

  You could also plot these over time like this:

  
  (_sourceCategory=app1 or  _sourceCategory=app2) "HTTP/1.1 500" 
  | timeslice 15m
  | count by _sourceCategory, _timeslice
  | transpose row _timeslice column _sourceCategory
  
  

  Comment actions Permalink
• 

  David Wynn

  • July 07, 2015 16:41

  Kelly,

  There's no way to combine two searches into one graph, but you can combine multiple aggregates in one query by comma separating them instead of pipe separating them. Then both sets of values will be available int he same panel.

  0

  Comment actions Permalink
• 

  Soumya Mandi

  • August 29, 2019 12:08

   I am trying to solve the same problem.
  
  I have two aggregate counts:
  1) _sourceCategory=app1 "HTTP/1.1 500" | count
  2) _sourceCategory=app2 "HTTP/1.1 500" | count

  How do I combine them in one table view? I didn't understand the "comma separating them" part and how to use it.

  0

  Comment actions Permalink

Please sign in to leave a comment.