I have scenario where:
Search 1:
base search | timechart count(field) by X
Search 2:
base search | timechart count(field2) by Y
Can I some how combine these to in a single base search and then have two post processed searches?
hi joydeep741,
try like this:
|set union [base search | timechart count(field) by X] [base search | timechart count(field2) by Y]
But by this approach i will be hitting the Raw data twice. So the purpose of post processing wont be served.