I'm trying to graph the total number of hits to our website alongside the total number of hits to a subset of pages within the site. I've seen a few examples using eval, stats, and append, but can't seem to make anything work
Here is what I have so far.....
index="iis_logs"
| eval SearchNumber="cs_uri_stem=/site1* OR cs_uri_stem=/site1a*"
| stats count(cs_uri_stem) by SearchNumber
| append [search index="iis_logs"
| eval SearchNumber=
"cs_uri_stem="*subsite1*" OR
cs_uri_stem="*subsite2*" OR
cs_uri_stem="*subsite3*" OR
cs_uri_stem="*subsite4*""
| stats count(cs_uri_stem)]
| timechart span=1h count by SearchNumber
... View more