https://community.splunk.com/t5/Dashboards-Visualizations/Visualisation-with-multiple-data/m-p/691649#M56671 <P>Assuming msgType extracts values such as SAP and TMD, try something like this</P><LI-CODE lang="markup">| rex field=message "MessageTemplate\\\":\\\"(?&lt;msgType&gt;[^\\\"]+)" | spath | search SAP OR TMD |timechart count by msgType</LI-CODE> Wed, 26 Jun 2024 11:36:17 GMT ITWhisperer 2024-06-26T11:36:17Z https://community.splunk.com/t5/Dashboards-Visualizations/Visualisation-with-multiple-data/m-p/691646#M56669 <P>Hi&nbsp;</P> <P>I am trying to get visualization in a way when i select multiple categories i see multiple lines in chart and when single value selected i need to get single line but unable to create chart when passing multiple values in categories Please help&nbsp;<BR /><BR /></P> <LI-CODE lang="markup">| rex field=message "MessageTemplate\\\":\\\"(?&lt;msgType&gt;[^\\\"]+)" | spath | search SAP OR TMD |timechart count by SAP or TMD</LI-CODE> <P><BR />Expecting result like below but this query gives error</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Kaushaas_0-1719400066427.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/31466i1B024CB0D22B5911/image-size/medium?v=v2&amp;px=400" role="button" title="Kaushaas_0-1719400066427.png" alt="Kaushaas_0-1719400066427.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">Kaushaas_0-1719400066427.png</span></span></P> <LI-CODE lang="markup">| rex field=message "MessageTemplate\\\":\\\"(?&lt;msgType&gt;[^\\\"]+)" | spath | search SAP | timechart count . This is coming fine as I have timechart given by count </LI-CODE> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Kaushaas_1-1719400135990.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/31467i53B761F2DAA53B80/image-size/medium?v=v2&amp;px=400" role="button" title="Kaushaas_1-1719400135990.png" alt="Kaushaas_1-1719400135990.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">Kaushaas_1-1719400135990.png</span></span>Thanks in advance<BR />Ashima<BR /><BR /></P> Wed, 26 Jun 2024 12:04:30 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Visualisation-with-multiple-data/m-p/691646#M56669 Kaushaas 2024-06-26T12:04:30Z https://community.splunk.com/t5/Dashboards-Visualizations/Visualisation-with-multiple-data/m-p/691649#M56671 <P>Assuming msgType extracts values such as SAP and TMD, try something like this</P><LI-CODE lang="markup">| rex field=message "MessageTemplate\\\":\\\"(?&lt;msgType&gt;[^\\\"]+)" | spath | search SAP OR TMD |timechart count by msgType</LI-CODE> Wed, 26 Jun 2024 11:36:17 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Visualisation-with-multiple-data/m-p/691649#M56671 ITWhisperer 2024-06-26T11:36:17Z