https://community.splunk.com/t5/Splunk-Search/timechart-for-post-for-multiple-web-sites/m-p/479381#M134357 <P>you cant timechart strings, what you need is timechart acount of get or post..something like |timechart count by post_method. You of course can not have 2 fields in the by clause.suggest using stats instead something like<BR /> |bin span=1h _time|stats count by post_method,portal</P> Wed, 30 Sep 2020 02:53:09 GMT Sukisen1981 2020-09-30T02:53:09Z https://community.splunk.com/t5/Splunk-Search/timechart-for-post-for-multiple-web-sites/m-p/479380#M134356 <P>I have multiple web portals.</P> <P>portal= <A href="http://www.xyz.com">www.xyz.com</A>, <A href="http://www.abc.com">www.abc.com</A><BR /> post_method = get | post</P> <P>Now I want a timechart like values(post_method) by portal<BR /> then I want to use trellis option like for each portal there is seperate graph with number of get and post requests.</P> Thu, 07 Nov 2019 08:21:03 GMT https://community.splunk.com/t5/Splunk-Search/timechart-for-post-for-multiple-web-sites/m-p/479380#M134356 riqbal47010 2019-11-07T08:21:03Z https://community.splunk.com/t5/Splunk-Search/timechart-for-post-for-multiple-web-sites/m-p/479381#M134357 <P>you cant timechart strings, what you need is timechart acount of get or post..something like |timechart count by post_method. You of course can not have 2 fields in the by clause.suggest using stats instead something like<BR /> |bin span=1h _time|stats count by post_method,portal</P> Wed, 30 Sep 2020 02:53:09 GMT https://community.splunk.com/t5/Splunk-Search/timechart-for-post-for-multiple-web-sites/m-p/479381#M134357 Sukisen1981 2020-09-30T02:53:09Z https://community.splunk.com/t5/Splunk-Search/timechart-for-post-for-multiple-web-sites/m-p/479382#M134358 <P>Like this:</P> <PRE><CODE>index="YouShouldAlwaysSpecifyAnIdex" AND sourcetype="AndSourcetypeToo" AND portal IN("www.xyz.com", "www.abc.com") | timechart count(eval(post_method=="get")) AS Gets count(eval(post_method=="post")) AS Posts BY portal </CODE></PRE> <P>Then the trellis function be functional and you can just click on which split you like ( <CODE>portal</CODE> or <CODE>post_method</CODE> )</P> Thu, 07 Nov 2019 14:57:32 GMT https://community.splunk.com/t5/Splunk-Search/timechart-for-post-for-multiple-web-sites/m-p/479382#M134358 woodcock 2019-11-07T14:57:32Z https://community.splunk.com/t5/Splunk-Search/timechart-for-post-for-multiple-web-sites/m-p/479383#M134359 <P>thanks </P> <P>it is working now as expected.</P> Mon, 11 Nov 2019 08:42:44 GMT https://community.splunk.com/t5/Splunk-Search/timechart-for-post-for-multiple-web-sites/m-p/479383#M134359 riqbal47010 2019-11-11T08:42:44Z