https://community.splunk.com/t5/Splunk-Dev/Why-is-my-search-to-chart-server-errors-per-host-over-a-24-hour/m-p/438207#M7930 <PRE><CODE>host="*" | bin span=1d _time| stats count(sc_status) as count by host sc_status </CODE></PRE> Thu, 18 Oct 2018 20:34:00 GMT Vijeta 2018-10-18T20:34:00Z https://community.splunk.com/t5/Splunk-Dev/Why-is-my-search-to-chart-server-errors-per-host-over-a-24-hour/m-p/438206#M7929 <P>Hey all, </P> <P>I am trying to show all iis errors separated by host over a 24 hour period. But, when I run the below command, it completes and says it has 200,000 plus results, but nothing shows up in the graph. Can anyone assist? </P> <P>Thanks. </P> <PRE><CODE>host="**" | chart list(host) over time by count(sc_status) span=1d </CODE></PRE> Thu, 18 Oct 2018 18:21:45 GMT https://community.splunk.com/t5/Splunk-Dev/Why-is-my-search-to-chart-server-errors-per-host-over-a-24-hour/m-p/438206#M7929 synking 2018-10-18T18:21:45Z https://community.splunk.com/t5/Splunk-Dev/Why-is-my-search-to-chart-server-errors-per-host-over-a-24-hour/m-p/438207#M7930 <PRE><CODE>host="*" | bin span=1d _time| stats count(sc_status) as count by host sc_status </CODE></PRE> Thu, 18 Oct 2018 20:34:00 GMT https://community.splunk.com/t5/Splunk-Dev/Why-is-my-search-to-chart-server-errors-per-host-over-a-24-hour/m-p/438207#M7930 Vijeta 2018-10-18T20:34:00Z https://community.splunk.com/t5/Splunk-Dev/Why-is-my-search-to-chart-server-errors-per-host-over-a-24-hour/m-p/438208#M7931 <P>Thank you this gets me more than I was able to before. But the chart will only show one server. Is there a way to show all servers and separate the status by status type instead of total count</P> Fri, 19 Oct 2018 11:52:24 GMT https://community.splunk.com/t5/Splunk-Dev/Why-is-my-search-to-chart-server-errors-per-host-over-a-24-hour/m-p/438208#M7931 synking 2018-10-19T11:52:24Z https://community.splunk.com/t5/Splunk-Dev/Why-is-my-search-to-chart-server-errors-per-host-over-a-24-hour/m-p/438209#M7932 <P>I was able to get the results I wanted by using the below command.</P> <PRE><CODE>|bin _time span=1d | chart sum(sc_status) list(sort(sc_status)) by host,sc_status </CODE></PRE> Fri, 19 Oct 2018 15:23:13 GMT https://community.splunk.com/t5/Splunk-Dev/Why-is-my-search-to-chart-server-errors-per-host-over-a-24-hour/m-p/438209#M7932 synking 2018-10-19T15:23:13Z