Splunk query to merge 2 timecharts as overlay

[Mathanjey]

Hello,

I have 2 timecharts that are working independently, can you help to merge both to one query (as overylay), the modified query should show timecharts based on 2 different source types and different criteria's.

Query 1 : index=index1 sourcetype="sourcetype1" "SearchString1"|timechart count span=1h
Query 2 : index=index1 sourcetype=sourcetype2 "SearchString2"=* | timechart count by "SearchString2"

[Mathanjey]

Hi somesoni2,

thanks for your input, I tried and it seems its not considering SearchString1 values, could you help me understand in detail as i could try/tweak it.

Thanks
Mathan J

[somesoni2]

Give this a try

index=index1 (sourcetype="sourcetype1" "SearchString1") OR (sourcetype=sourcetype2 "SearchString2"=*)
| eval "SearchString2"=if(sourcetype="sourcetype1","count",'SearchString2')
| timechart count by "SearchString2"