https://community.splunk.com/t5/Dashboards-Visualizations/how-todisplay-more-than-one-field-on-bar-chart/m-p/354594#M39951 <P>The chart command support aggregation by just two fields, so you'd have to try the workaround of concatenating two fields into one and use concatenated field in by clause.</P> <PRE><CODE>search | eval "IP_address/OtherField"=IP_address.":".OtherField | chart count over host by "IP_address/OtherField" </CODE></PRE> Fri, 02 Feb 2018 20:27:01 GMT somesoni2 2018-02-02T20:27:01Z https://community.splunk.com/t5/Dashboards-Visualizations/how-todisplay-more-than-one-field-on-bar-chart/m-p/354593#M39950 <P>I want to set up a Bar graph that displays more than one field when I hover over it. For example I use:</P> <P>search | chart count over host by IP_address</P> <P>so this is displaying just the host on the actual graph BUT also shows me the IP_address if I hover over my mouse to that specific bar.</P> <P>Now, I also want to add one more field to display when I hover on a specific bar .</P> Fri, 02 Feb 2018 19:13:51 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-todisplay-more-than-one-field-on-bar-chart/m-p/354593#M39950 navd 2018-02-02T19:13:51Z https://community.splunk.com/t5/Dashboards-Visualizations/how-todisplay-more-than-one-field-on-bar-chart/m-p/354594#M39951 <P>The chart command support aggregation by just two fields, so you'd have to try the workaround of concatenating two fields into one and use concatenated field in by clause.</P> <PRE><CODE>search | eval "IP_address/OtherField"=IP_address.":".OtherField | chart count over host by "IP_address/OtherField" </CODE></PRE> Fri, 02 Feb 2018 20:27:01 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-todisplay-more-than-one-field-on-bar-chart/m-p/354594#M39951 somesoni2 2018-02-02T20:27:01Z