Hey guys and girls,
I am trying to create a diagram witth follwing input:
I have two queries
search index= blabla host = | timechart sum(bytes)
search index=blabla host="youtube"| timechart sum (bytes)*
for both of the searches i get a wonderfull timechart.
My issue is to combine them in a one time chart
Y -Axis amout of bytes
X- Time
I tried append/ appendcols
I tried index...| where host= OR host =youtube | timechart...*
Did not work
Hi,
Try this:
index=blabla
| eval group=if(host="youtube",host,"others")
| timechart sum(bytes) by group
Hi,
Try this:
index=blabla
| eval group=if(host="youtube",host,"others")
| timechart sum(bytes) by group
maybe:
index = blabla host=YouTube OR host="other_host" OR host="another_host" OR .... | timechart sum(bytes) as total_bytes by host