topic Re: Graph by field value not by field count in Splunk Search

Graph by field value not by field count

fizwit — Mon, 28 Sep 2020 13:57:33 GMT

Why can't I make a graph by field value directly?

This works:
index=logs Error_Type="WARN" | timechart count(Error_Type)

This does not
index=logs | timechart count(Error_Type="WARN")

I would like to to this graph two types of error on the same pannel
index=logs | timechart count(Error_Type="WARN"), count(Error_Type="ERROR")

chris — Wed, 22 May 2013 17:50:47 GMT

Hi fizwit,

this is possible have a look at the documentation of the timechart command (Example 5) you were pretty close there is just an eval missing:

 index=logs | timechart count(eval(Error_Type="WARN")) AS WARN, count(eval(Error_Type="ERROR")) AS ERROR

Good luck

Chris

fizwit — Wed, 22 May 2013 18:02:55 GMT

Thanks, that worked perfectly!