https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-one-chart/m-p/473548#M133236 <P>It would be helpful if you could post some sample data. Does your data have the _time field?</P> <P>If you want a chart with time as the X-axis, then take a look at timechart.</P> <P>Try something like this:</P> <PRE><CODE>... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause </CODE></PRE> Fri, 06 Sep 2019 15:54:49 GMT whrg 2019-09-06T15:54:49Z https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-one-chart/m-p/473547#M133235 <P>Hi, <BR /> I struggling to create chart, which will be with multiple field values (max,avg and min pauses) + need to see months (January, February, March etc.) in X-Axis</P> <P>What I need to change here?<BR /> <CODE>| eval fields=split(_raw," ")<BR /> | eval pauses=mvindex(fields,8) <BR /> | eventstats max(pauses) as Max_pause<BR /> | eventstats avg(pauses) as Avg_pause<BR /> | eventstats min(pauses) as Min_pause<BR /> | table Max_pause Avg_pause Min_pause</CODE></P> Fri, 06 Sep 2019 14:51:21 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-one-chart/m-p/473547#M133235 pudanelilita 2019-09-06T14:51:21Z https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-one-chart/m-p/473548#M133236 <P>It would be helpful if you could post some sample data. Does your data have the _time field?</P> <P>If you want a chart with time as the X-axis, then take a look at timechart.</P> <P>Try something like this:</P> <PRE><CODE>... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause </CODE></PRE> Fri, 06 Sep 2019 15:54:49 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-one-chart/m-p/473548#M133236 whrg 2019-09-06T15:54:49Z https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-one-chart/m-p/473549#M133237 <P>It worked without <STRONG>span=1mon</STRONG>, thanks!</P> Mon, 09 Sep 2019 07:57:22 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-fields-in-one-chart/m-p/473549#M133237 pudanelilita 2019-09-09T07:57:22Z