topic Re: How do you Timechart by multiple fields? in Splunk Search

How do you Timechart by multiple fields?

Esperteyu — Mon, 08 Oct 2018 22:12:21 GMT

Hi,

I'm struggling with the below query "presentable" in a dashboard. Initially, my idea was to have time on the x-axis, and the count of events on the y-axis, and columns for each scheme stacking the countries (if that makes sense, I thought could be a viable visualization) but can't make it work although the search gives the correct values

index="my_index" base_search 
| rex field=_raw "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex field=_raw "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| stats count by country, scheme

Thanks

Re: How do you Timechart by multiple fields?

woodcock — Mon, 08 Oct 2018 22:21:04 GMT

You have to create an aggregate field like this:

index="my_index" base_search 
| rex "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| eval country_scheme = country . ":" . scheme
| timechart count BY country_scheme

Re: How do you Timechart by multiple fields?

rojyates — Fri, 25 Oct 2019 02:25:02 GMT

An alternative to | eval country_scheme = country . ":" . scheme is to use strcat:

| strcat country ":" scheme country_scheme
| timechart count BY country_scheme