Hi
I have this search which graphs calls to phone numbers
index=myindex sourcetype=mysource Number IN (5551,5555,55557,3249,2850,3353,6150)
| timechart span=1h count by Number
I have a different search that returns bad calls.
index=myindex sourcetype=mysource "1 4 3 1"
| stats count as BAD
I want to overlay the count of bad calls from search 2 on the timechart from search one
Thanks. The data is call records for phones calls. Every call record has a phone number (which is a defined field) so in the first query (using the IN) I'm looking for a few phone numbers that belong to a customer. The records contain details of call results. A call which has been blocked will have a string "1 4 3 1" (not a defined field). So I want to show a graph of the calls to the phone numbers (which the first query above does) and then overlay the blocked calls. Only a small number of calls are blocked (contain "1 4 3 1") .
Your overlay should have the same x-axis as your main data, in your case this appears to be _time from the first query but that doesn't appear in your second query, so you would need to fix that. It isn't clear whether "1 4 3 1" is also a Number or a different field, nor whether BAD numbers are mutually exclusive with Numbers in your IN list. Please can you describe your data and what you are trying to achieve a bit more clearly