<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Timechart multiple values per day in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-multiple-values-per-day/m-p/505841#M33604</link>
    <description>&lt;P&gt;I have a dataset and looking for a timechart span=1d for the data I have from a location.&amp;nbsp;&lt;/P&gt;&lt;P&gt;| table _time Cases Hospitalizations ICO Recoveries Deaths&lt;/P&gt;&lt;P&gt;I want to display all these in one chart y exis over the past 7 days.&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Tue, 23 Jun 2020 22:34:46 GMT</pubDate>
    <dc:creator>jenkinsta</dc:creator>
    <dc:date>2020-06-23T22:34:46Z</dc:date>
    <item>
      <title>Timechart multiple values per day</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-multiple-values-per-day/m-p/505841#M33604</link>
      <description>&lt;P&gt;I have a dataset and looking for a timechart span=1d for the data I have from a location.&amp;nbsp;&lt;/P&gt;&lt;P&gt;| table _time Cases Hospitalizations ICO Recoveries Deaths&lt;/P&gt;&lt;P&gt;I want to display all these in one chart y exis over the past 7 days.&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 23 Jun 2020 22:34:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-multiple-values-per-day/m-p/505841#M33604</guid>
      <dc:creator>jenkinsta</dc:creator>
      <dc:date>2020-06-23T22:34:46Z</dc:date>
    </item>
    <item>
      <title>Re: Timechart multiple values per day</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-multiple-values-per-day/m-p/505847#M33605</link>
      <description>&lt;P&gt;How about&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| timechart span=1d sum(Cases) as Cases sum(Hospitalizations) as Hospitalizations sum(ICO) as ICO sum(Recoveries) as Recoveries sum(Deaths) as Deaths&lt;/LI-CODE&gt;&lt;P&gt;However, there are 5 data elements above, but how many locations do you have and what granularity is _time in your source data, as sum() might not be the correct aggregation, e.g. if the value in your data reflects the latest value at that time, then max() would be correct.&lt;/P&gt;&lt;P&gt;but if you have a location split by then you will rapidly reach a number of series on the chart that will make it unreadable.&lt;/P&gt;</description>
      <pubDate>Tue, 23 Jun 2020 23:35:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Timechart-multiple-values-per-day/m-p/505847#M33605</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2020-06-23T23:35:31Z</dc:date>
    </item>
  </channel>
</rss>

