https://community.splunk.com/t5/Splunk-Search/Chart-Values-Quesiton/m-p/242152#M188948 <P><CODE>...| chart count by field1, field2</CODE></P> Fri, 22 Jan 2016 21:54:05 GMT skoelpin 2016-01-22T21:54:05Z https://community.splunk.com/t5/Splunk-Search/Chart-Values-Quesiton/m-p/242150#M188946 <P>Is there a way to chart values(count) by more than two fields</P> Fri, 22 Jan 2016 21:35:39 GMT https://community.splunk.com/t5/Splunk-Search/Chart-Values-Quesiton/m-p/242150#M188946 hastrike 2016-01-22T21:35:39Z https://community.splunk.com/t5/Splunk-Search/Chart-Values-Quesiton/m-p/242151#M188947 <P>You can create a field by concatenating multiple field and use that as second field in chart. E.g. show count of event over source by component and group</P> <PRE><CODE>index=_internal sourcetype=splunkd | eval component=component.":".group | chart count over source by component </CODE></PRE> Fri, 22 Jan 2016 21:48:56 GMT https://community.splunk.com/t5/Splunk-Search/Chart-Values-Quesiton/m-p/242151#M188947 somesoni2 2016-01-22T21:48:56Z https://community.splunk.com/t5/Splunk-Search/Chart-Values-Quesiton/m-p/242152#M188948 <P><CODE>...| chart count by field1, field2</CODE></P> Fri, 22 Jan 2016 21:54:05 GMT https://community.splunk.com/t5/Splunk-Search/Chart-Values-Quesiton/m-p/242152#M188948 skoelpin 2016-01-22T21:54:05Z