https://community.splunk.com/t5/Splunk-Search/Chart-or-timechart-by-multiple-values/m-p/549256#M155838 <P>I have a chart that I can split by myDate or env, but I cannot get it to split by both myDate and env for example I need to see how many urgency events have taken place on a given myDate by each of the env (environments).</P><P>I have used multiple versions of splitting the code and just cannot get this right - any help will be great, this is related to Splunk ES.</P><P>`notable`<BR />| eval env=coalesce(src_bunit, dvc_bunit, dest_bunit)<BR />| eval env=upper(env)<BR />| fillnull value="Unknown" env<BR />| search NOT `suppression` AND env=*<BR />| eval myDate=strftime(_time, "%Y-%m-%d")<BR />| chart count by env urgency<BR />| table myDate env critical high medium low informational<BR />| fillnull critical high medium low informational<BR />| rename env AS Environment, critical AS Critical, high AS High, medium AS Medium, low AS Low, informational AS Informational<BR />| addtotals col=true labelfield=Environment label="Total(s)" row=true</P> Sun, 25 Apr 2021 07:41:49 GMT sherpedz 2021-04-25T07:41:49Z https://community.splunk.com/t5/Splunk-Search/Chart-or-timechart-by-multiple-values/m-p/549256#M155838 <P>I have a chart that I can split by myDate or env, but I cannot get it to split by both myDate and env for example I need to see how many urgency events have taken place on a given myDate by each of the env (environments).</P><P>I have used multiple versions of splitting the code and just cannot get this right - any help will be great, this is related to Splunk ES.</P><P>`notable`<BR />| eval env=coalesce(src_bunit, dvc_bunit, dest_bunit)<BR />| eval env=upper(env)<BR />| fillnull value="Unknown" env<BR />| search NOT `suppression` AND env=*<BR />| eval myDate=strftime(_time, "%Y-%m-%d")<BR />| chart count by env urgency<BR />| table myDate env critical high medium low informational<BR />| fillnull critical high medium low informational<BR />| rename env AS Environment, critical AS Critical, high AS High, medium AS Medium, low AS Low, informational AS Informational<BR />| addtotals col=true labelfield=Environment label="Total(s)" row=true</P> Sun, 25 Apr 2021 07:41:49 GMT https://community.splunk.com/t5/Splunk-Search/Chart-or-timechart-by-multiple-values/m-p/549256#M155838 sherpedz 2021-04-25T07:41:49Z https://community.splunk.com/t5/Splunk-Search/Chart-or-timechart-by-multiple-values/m-p/549259#M155839 <P>chart loses myDate. Try using stats and then create a field with the name for the series and use that for the xyseries. Something like this:</P><LI-CODE lang="markup">`notable` | eval env=coalesce(src_bunit, dvc_bunit, dest_bunit) | eval env=if(like(env,"%tgw%") OR like(env,"%TGW%"),"DCT",env) | eval env=upper(env) | fillnull value="Unknown" env | search NOT `suppression` AND env=* | eval myDate=strftime(_time, "%Y-%m-%d") | stats count by myDate env urgency | eval envurgency=env.":".urgency | xyseries myDate envurgency count</LI-CODE><P>&nbsp;</P> Sun, 25 Apr 2021 07:58:20 GMT https://community.splunk.com/t5/Splunk-Search/Chart-or-timechart-by-multiple-values/m-p/549259#M155839 ITWhisperer 2021-04-25T07:58:20Z