https://community.splunk.com/t5/Splunk-Dev/timechart-with-dynamic-data-series/m-p/358571#M5804 <P>@yww325, I have converted @somesoni2 's comment to answer. Please accept to mark this as answered.<BR /> Also make sure you post your comments using <CODE>Add comment</CODE> for specific thread instead of posting a new answer.</P> Fri, 29 Dec 2017 02:37:08 GMT niketn 2017-12-29T02:37:08Z https://community.splunk.com/t5/Splunk-Dev/timechart-with-dynamic-data-series/m-p/358568#M5801 <P>I found a document saying you can create multiple data series here:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Chartmultipledataseries">http://docs.splunk.com/Documentation/Splunk/latest/Search/Chartmultipledataseries</A><BR /> But the number of data series is a fixed value, you have to specify these names and conditions for each of them.<BR /> In my case, let's assume we have a ReturnCode field and an AppName field in the search return, the return number could be any number. <BR /> I want to see a timely distribution, so I used time chart, and I also want data series group by AppName and ReturnCode, so now I use like | timechart count(eval(ReturnCode=1)) as 1, count(eval(ReturnCode=2)) as 2 by AppName <BR /> But I realize the ReturnCode can be totally different according to the application(AppName), for AppA, return code can be 1,2,3,4; for AppB, return code can be 2,3,5. I want one colored data series for each combination of AppName+ReturnCode in the timechart<BR /> How can I achieve that?</P> Thu, 28 Dec 2017 18:56:35 GMT https://community.splunk.com/t5/Splunk-Dev/timechart-with-dynamic-data-series/m-p/358568#M5801 yww325 2017-12-28T18:56:35Z https://community.splunk.com/t5/Splunk-Dev/timechart-with-dynamic-data-series/m-p/358569#M5802 <P>Give this a try</P> <PRE><CODE>your base search | eval App_RC=AppName.":".ReturnCode | timechart count by App_RC </CODE></PRE> Thu, 28 Dec 2017 20:17:37 GMT https://community.splunk.com/t5/Splunk-Dev/timechart-with-dynamic-data-series/m-p/358569#M5802 somesoni2 2017-12-28T20:17:37Z https://community.splunk.com/t5/Splunk-Dev/timechart-with-dynamic-data-series/m-p/358570#M5803 <P>Yes, that will work, thank you.</P> Thu, 28 Dec 2017 22:27:44 GMT https://community.splunk.com/t5/Splunk-Dev/timechart-with-dynamic-data-series/m-p/358570#M5803 yww325 2017-12-28T22:27:44Z https://community.splunk.com/t5/Splunk-Dev/timechart-with-dynamic-data-series/m-p/358571#M5804 <P>@yww325, I have converted @somesoni2 's comment to answer. Please accept to mark this as answered.<BR /> Also make sure you post your comments using <CODE>Add comment</CODE> for specific thread instead of posting a new answer.</P> Fri, 29 Dec 2017 02:37:08 GMT https://community.splunk.com/t5/Splunk-Dev/timechart-with-dynamic-data-series/m-p/358571#M5804 niketn 2017-12-29T02:37:08Z