Multiple key value pairs in a timechart based on the counts of 2 fields

datatan — Thu, 30 Sep 2021 22:44:05 GMT

Here's an example of some error logs that simply show which app reported an error and which country:

_time(s)	sourcetype	country
0	app1	US
1	app1	DE
2	app2	DE
65	app2	US
66	app2	US
67	app1	DE

Here's the timechart I would like to retrieve(span=1m):

_time	app1	app2
2021-09-30 00:00:00	{"US": 1, "DE": 1}	{"DE": 1}
2021-09-30 00:01:00	{"DE": 1}	{"US": 2}

Is this, or something similar, possible?

Re: Multiple key value pairs in a timechart based on the counts of 2 fields

ITWhisperer — Fri, 01 Oct 2021 06:10:25 GMT

Here is a runanywhere example - the part before the blank lines just sets up the dummy data

| makeresults | eval _raw="_time(s) sourcetype country 0 app1 US 1 app1 DE 2 app2 DE 65 app2 US 66 app2 US 67 app1 DE" | multikv forceheader=1 | eval _time=relative_time(_time,"@m")+time_s_ | bin _time span=1m | stats count by _time sourcetype country | eval results="\"".country."\": ".count | stats values(results) as results by _time sourcetype | eval results="{".mvjoin(results,", ")."}" | xyseries _time sourcetype results

topic Multiple key value pairs in a timechart based on the counts of 2 fields in Splunk Search

Multiple key value pairs in a timechart based on the counts of 2 fields

Re: Multiple key value pairs in a timechart based on the counts of 2 fields