I am trying to combine two searches into one chart. I am trying the append command, but am not having any luck getting it to work. Can anyone help?
index=ff host=prdecomapp03.panerabread.com OR host=prdecomapp04.panerabread.com "TIMEOUT while requesting a token lookup transaction*" | timechart span=1d count | append [index=ff host=prdecomapp03.panerabread.com OR host=prdecomapp04.panerabread.com "TIMEOUT while requesting a payment transaction*"]
Why not combine the searches?
(index=ff host=prdecomapp03.panerabread.com OR host=prdecomapp04.panerabread.com) ("TIMEOUT while requesting a token lookup transaction*" OR "TIMEOUT while requesting a payment transaction*") | timechart span=1d count