Yes!
yoursearchhere
| eval source=if(source=="cat" OR source=="dog","animal",source)
| timechart count by source
Sure thing, you will have to evaluate a new field and use the chart command instead. If you want it by day you will need to add the bucket command. Something of this effect:
your search | eval animal=(cat+dog) | bucket span=1d _time | chart sum(animal) as animal, sum(car) as car by _time
Yes!
yoursearchhere
| eval source=if(source=="cat" OR source=="dog","animal",source)
| timechart count by source
thanks it works great