https://community.splunk.com/t5/Splunk-Search/multikv-and-timechart-changing-the-default-label-of-line-in/m-p/58659#M14383 <P>As suggested, this worked and gave me the result I wanted: index="os" host="myhost" source="ps" | multikv | eval pidAndCommand=PID." ".COMMAND | timechart avg(pctCPU) by pidAndCommand</P> Fri, 15 Mar 2013 03:15:05 GMT anuragkapur 2013-03-15T03:15:05Z https://community.splunk.com/t5/Splunk-Search/multikv-and-timechart-changing-the-default-label-of-line-in/m-p/58657#M14381 <P>I am trying to plot the CPU utilisation of all processes on a Solaris server using the following search query:<BR /> index="os" host="myhost" source="ps" | multikv fields PID pctCPU COMMAND forceheader=1 | timechart avg(pctCPU) by PID</P> <P>This works, but I would like the lines in my chart to be labelled with the COMMAND field rather than PID. I can't change the "by" clause to COMMAND as more than one process has the same value for the COMMAND field.</P> <P>Could someone please suggest a way of achieving this?</P> Tue, 12 Mar 2013 14:47:07 GMT https://community.splunk.com/t5/Splunk-Search/multikv-and-timechart-changing-the-default-label-of-line-in/m-p/58657#M14381 anuragkapur 2013-03-12T14:47:07Z https://community.splunk.com/t5/Splunk-Search/multikv-and-timechart-changing-the-default-label-of-line-in/m-p/58658#M14382 <P>You could append the command to the pid and use that as your grouping field.</P> Tue, 12 Mar 2013 16:30:19 GMT https://community.splunk.com/t5/Splunk-Search/multikv-and-timechart-changing-the-default-label-of-line-in/m-p/58658#M14382 martin_mueller 2013-03-12T16:30:19Z https://community.splunk.com/t5/Splunk-Search/multikv-and-timechart-changing-the-default-label-of-line-in/m-p/58659#M14383 <P>As suggested, this worked and gave me the result I wanted: index="os" host="myhost" source="ps" | multikv | eval pidAndCommand=PID." ".COMMAND | timechart avg(pctCPU) by pidAndCommand</P> Fri, 15 Mar 2013 03:15:05 GMT https://community.splunk.com/t5/Splunk-Search/multikv-and-timechart-changing-the-default-label-of-line-in/m-p/58659#M14383 anuragkapur 2013-03-15T03:15:05Z