https://community.splunk.com/t5/Splunk-Search/Timechart-with-different-bar-color/m-p/454394#M128572 <P>My splunk query is </P> <PRE><CODE>index=abc "Server started successfully" OR "Get Operation" OR "POST operation" OR "Error occurred" </CODE></PRE> <P>I want to get a timechart which shows when each these events occurred. Probably bar having a different color for each event or any other way which lets me identify if there was any "Get Operation" OR "POST Operation" between "Server started successfully" and "Error occurred"</P> Tue, 02 Jul 2019 19:10:23 GMT pankajad 2019-07-02T19:10:23Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-different-bar-color/m-p/454394#M128572 <P>My splunk query is </P> <PRE><CODE>index=abc "Server started successfully" OR "Get Operation" OR "POST operation" OR "Error occurred" </CODE></PRE> <P>I want to get a timechart which shows when each these events occurred. Probably bar having a different color for each event or any other way which lets me identify if there was any "Get Operation" OR "POST Operation" between "Server started successfully" and "Error occurred"</P> Tue, 02 Jul 2019 19:10:23 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-different-bar-color/m-p/454394#M128572 pankajad 2019-07-02T19:10:23Z https://community.splunk.com/t5/Splunk-Search/Timechart-with-different-bar-color/m-p/454395#M128573 <P>Not the cleanest but I should work to get a timechart counting the number of occurrences for each:</P> <PRE><CODE>| eval result = case(like(_raw, "%Server started successfully%"),"Server started successfully",like(_raw, "%Get Operation%"),"Get Operation",like(_raw, "%POST operation%"),"POST operation",like(_raw, "%Error occurred%"),"Error occurred") | timechart count(_raw) by result </CODE></PRE> Wed, 03 Jul 2019 17:31:29 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-with-different-bar-color/m-p/454395#M128573 aohls 2019-07-03T17:31:29Z