https://community.splunk.com/t5/Splunk-Search/Timechart-Split-by-Multiple-Fields-for-Trellis/m-p/425551#M122000 <P>Is there a way to split timechart by more than two fields so that I can use a trellis layout for the visualization? (Kind of analogous to a 3D Table?) </P> <P>Ex: I want to compare the trend of the cost over time for different companies in different countries. The following search has all the data I need. I can then split by country with trellis layout but will not be able to see the comparison between companies. </P> <PRE><CODE>| stats avg(cost) by _time, Company, Country </CODE></PRE> <P>The following works, but I would then need to create individual panels for every country I am interested in. </P> <PRE><CODE>| search Country = "USA" | timechart avg(cost) by Company </CODE></PRE> <P>This gets closer..but the timechart is still not able to split by the "Company" field </P> <PRE><CODE>| eval temp = _time."-".Company | xyseries temp,Country, cost | rex field=temp "(?&lt;_time&gt;([^\s]+))-(?&lt;Company&gt;\w+)" | fields - temp </CODE></PRE> <P>Any advice would be much appreciated!</P> Wed, 24 Apr 2019 21:25:48 GMT trikppy 2019-04-24T21:25:48Z https://community.splunk.com/t5/Splunk-Search/Timechart-Split-by-Multiple-Fields-for-Trellis/m-p/425551#M122000 <P>Is there a way to split timechart by more than two fields so that I can use a trellis layout for the visualization? (Kind of analogous to a 3D Table?) </P> <P>Ex: I want to compare the trend of the cost over time for different companies in different countries. The following search has all the data I need. I can then split by country with trellis layout but will not be able to see the comparison between companies. </P> <PRE><CODE>| stats avg(cost) by _time, Company, Country </CODE></PRE> <P>The following works, but I would then need to create individual panels for every country I am interested in. </P> <PRE><CODE>| search Country = "USA" | timechart avg(cost) by Company </CODE></PRE> <P>This gets closer..but the timechart is still not able to split by the "Company" field </P> <PRE><CODE>| eval temp = _time."-".Company | xyseries temp,Country, cost | rex field=temp "(?&lt;_time&gt;([^\s]+))-(?&lt;Company&gt;\w+)" | fields - temp </CODE></PRE> <P>Any advice would be much appreciated!</P> Wed, 24 Apr 2019 21:25:48 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-Split-by-Multiple-Fields-for-Trellis/m-p/425551#M122000 trikppy 2019-04-24T21:25:48Z