I'm trying to get a chart that displays the number of events where ProcessingTime was less than 1 second, between 1 and 2 seconds, and greater than 2 seconds within a certain time frame, and displaying that as 3 separate lines on a chart.
I can search for these stats individually:
search command ProcessingTime<1 | timechart span=10s count by _count
search command ProcessingTime>1 ProcessingTime<2 | timechart span=10s count by _count
etc
But what I want is multiple lines in one chart depending on which "bucket" the field value falls into. Unfortunately I'm not sure what I should be searching for to find what I want to do. Any tips?
... View more