https://community.splunk.com/t5/Getting-Data-In/Display-timechart-quot-BY-quot-multiple-lines-in-one-chart/m-p/46801#M8848 <P>I am not sure why you need the <CODE>eval</CODE>. Does the following work?</P> <PRE><CODE>host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory" | where MESSAGE like "%Low Power%" | rex field=MESSAGE "Power :(?&lt;Voltage&gt;.{5})" | timechart span=1d min(LowVolt) as LowVoltage by DEVICE </CODE></PRE> Tue, 28 May 2013 19:50:55 GMT lguinn2 2013-05-28T19:50:55Z https://community.splunk.com/t5/Getting-Data-In/Display-timechart-quot-BY-quot-multiple-lines-in-one-chart/m-p/46800#M8847 <P>I have a search with a timechart grouped by a fieldname that would like to displayed on a multilines chart on the same graph, How i can do that?</P> <PRE><CODE>host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory" | where MESSAGE like "%Low Power%" | rex field=MESSAGE "Power :(?&lt;Voltage&gt;.{5})" | timechart span=1d eval(min(LowVolt)) as LowVoltage by DEVICE </CODE></PRE> Mon, 27 May 2013 16:26:56 GMT https://community.splunk.com/t5/Getting-Data-In/Display-timechart-quot-BY-quot-multiple-lines-in-one-chart/m-p/46800#M8847 royimad 2013-05-27T16:26:56Z https://community.splunk.com/t5/Getting-Data-In/Display-timechart-quot-BY-quot-multiple-lines-in-one-chart/m-p/46801#M8848 <P>I am not sure why you need the <CODE>eval</CODE>. Does the following work?</P> <PRE><CODE>host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory" | where MESSAGE like "%Low Power%" | rex field=MESSAGE "Power :(?&lt;Voltage&gt;.{5})" | timechart span=1d min(LowVolt) as LowVoltage by DEVICE </CODE></PRE> Tue, 28 May 2013 19:50:55 GMT https://community.splunk.com/t5/Getting-Data-In/Display-timechart-quot-BY-quot-multiple-lines-in-one-chart/m-p/46801#M8848 lguinn2 2013-05-28T19:50:55Z