https://community.splunk.com/t5/Splunk-Search/Splitting-multiple-unknown-fields-to-timechart-by-another-field/m-p/67230#M16801 <P>Try this:</P> <P>index=internal | timechart avg(<EM>) as "avg</EM>" by host</P> Wed, 19 Jun 2013 08:09:41 GMT rechteklebe 2013-06-19T08:09:41Z https://community.splunk.com/t5/Splunk-Search/Splitting-multiple-unknown-fields-to-timechart-by-another-field/m-p/67229#M16800 <P>Hi,</P> <P>I've been using * in statistical commands for shorthand in writing out the fields. This has been useful on dynamic dashboards where I don't know what source/sourcetype a user will choose, so I don't have to specify field names ahead of time. A format like the following works:<BR /> <PRE><CODE><BR /> index=<EM>internal | timechart avg(*) as avg</EM>*<BR /> </CODE></PRE><BR /> but this one returns no results:<BR /> <PRE><CODE><BR /> index=<EM>internal | timechart avg(*) as avg</EM>* by host<BR /> </CODE></PRE><BR /> I'm guessing the * is eating the host field before the timechart command tries to split by it. Is there anything I can do about this? I'm running 4.3.4.</P> Tue, 18 Jun 2013 17:28:17 GMT https://community.splunk.com/t5/Splunk-Search/Splitting-multiple-unknown-fields-to-timechart-by-another-field/m-p/67229#M16800 cphair 2013-06-18T17:28:17Z https://community.splunk.com/t5/Splunk-Search/Splitting-multiple-unknown-fields-to-timechart-by-another-field/m-p/67230#M16801 <P>Try this:</P> <P>index=internal | timechart avg(<EM>) as "avg</EM>" by host</P> Wed, 19 Jun 2013 08:09:41 GMT https://community.splunk.com/t5/Splunk-Search/Splitting-multiple-unknown-fields-to-timechart-by-another-field/m-p/67230#M16801 rechteklebe 2013-06-19T08:09:41Z https://community.splunk.com/t5/Splunk-Search/Splitting-multiple-unknown-fields-to-timechart-by-another-field/m-p/67231#M16802 <P>the stars are filtered out..so for sure with the stars <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 19 Jun 2013 08:46:08 GMT https://community.splunk.com/t5/Splunk-Search/Splitting-multiple-unknown-fields-to-timechart-by-another-field/m-p/67231#M16802 rechteklebe 2013-06-19T08:46:08Z https://community.splunk.com/t5/Splunk-Search/Splitting-multiple-unknown-fields-to-timechart-by-another-field/m-p/67232#M16803 <P>Doesn't work. Same problem.</P> Wed, 19 Jun 2013 11:57:19 GMT https://community.splunk.com/t5/Splunk-Search/Splitting-multiple-unknown-fields-to-timechart-by-another-field/m-p/67232#M16803 cphair 2013-06-19T11:57:19Z