I have three timecharts which I want to sum together.
index="commercial_performance" Cat1="Entitlement *" | timechart limit=0 sum(Value) by Service_line
index="commercial_performance" Cat1="Efficiency *" | timechart limit=0 sum(Value) by Service_line
index="commercial_performance" Cat1="Intervention *" | timechart limit=0 sum(Value) by Service_line
I have tried appendcols but it didn't seen to work. Can someone help?
Try something like this (to get one sum of Value per Service_line for all of Cat1 field)
index="commercial_performance" Cat1="Entitlement *" OR Cat1="Efficiency *" OR Cat1="Intervention *" | timechart limit=0 sum(Value) by Service_line
If you want have one sum of Value per Service_line per Cat1, tryr this
index="commercial_performance" Cat1="Entitlement *" OR Cat1="Efficiency *" OR Cat1="Intervention *" | eval Service_line=Service_line."-".Cat1| timechart limit=0 sum(Value) by Service_line
Try something like this (to get one sum of Value per Service_line for all of Cat1 field)
index="commercial_performance" Cat1="Entitlement *" OR Cat1="Efficiency *" OR Cat1="Intervention *" | timechart limit=0 sum(Value) by Service_line
If you want have one sum of Value per Service_line per Cat1, tryr this
index="commercial_performance" Cat1="Entitlement *" OR Cat1="Efficiency *" OR Cat1="Intervention *" | eval Service_line=Service_line."-".Cat1| timechart limit=0 sum(Value) by Service_line