How can I combine two fields so that the labeling in one of the fields show up as one in the timechart visualization view?

pcnca — Thu, 25 Jul 2019 12:44:26 GMT

How can I combine two fields so that the labeling in the of the fields show up as one in the timechart visualization view?

i.e. from this searched Event, trying to combine “ hostname & port” , so that in the timechart it shows something like this ny9710c02_ fc2/23, currently I’ve been only able to get either one of these fields to display.

hostname = ny9710c02

port= fc2/23

" TXWait " source="SAN-45147" NOT *FALLING*| timechart count by hostname limit=10 

Time    Event
    7/23/19
3:01:19.778 PM  <43>2019-07-23T15:01:19.778405+00:00 ny9710c02.com 1.1.1.4 : 2019 Jul 23 11:01:19 EDT: %PMON-SLOT2-3-RISING_THRESHOLD_REACHED: TXWait has reached the rising threshold (port=fc2/23 [0x1096000], value=40) .

Re: How can I combine two fields so that the labeling in one of the fields show up as one in the timechart visualization view?

vnravikumar — Thu, 25 Jul 2019 16:07:26 GMT

Try like

|eval hostname_port = hostname."_".port| timechart count by hostname_port limit=10

topic How can I combine two fields so that the labeling in one of the fields show up as one in the timechart visualization view? in Dashboards & Visualizations

How can I combine two fields so that the labeling in one of the fields show up as one in the timechart visualization view?

Re: How can I combine two fields so that the labeling in one of the fields show up as one in the timechart visualization view?