topic Re: how to show separate line for different site in one chart? in Splunk Search

how to show separate line for different site in one chart?

florapann — Thu, 04 Nov 2021 19:10:03 GMT

from checkbox value, if i choose multiple sites, i would like to show all sites separate line chart for average trackout time. now the problem if i choose multiple sites, it only show one line chart by coming all sites average trackout value.

query: MicronSite IN($site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h avg(command_time)

For example: from check box list i choose "F10N" and "F10W". but in chart, only show one line by combing those two site's average trackout time values and show one chart. i would like to show two separate line , one line for F10N's average trackout time and another line for F10W's average trackout time.

please help to suggest for this issue

Re: how to show separate line for different site in one chart?

ITWhisperer — Thu, 04 Nov 2021 19:26:56 GMT

MicronSite IN($site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h avg(command_time) by MicronSite

Re: how to show separate line for different site in one chart?

florapann — Thu, 04 Nov 2021 20:05:27 GMT

i got below error when i run your query

Re: how to show separate line for different site in one chart?

somesoni2 — Thu, 04 Nov 2021 20:10:57 GMT

Just add "by MicronSite" in your timechart command (at the end).

Re: how to show separate line for different site in one chart?

PickleRick — Thu, 04 Nov 2021 20:32:23 GMT

Hey, that was your own regex. 🙂

I assume that there should be a capturing group name there. So instead of

(?\d+)

You should have something like

(?<your_field>\d+)

Re: how to show separate line for different site in one chart?

florapann — Thu, 04 Nov 2021 20:59:19 GMT

got it thanks alot 😄
if i want to combine another one more chart into that dashboard with different query, is it possible? it produce same average total trackout time but different source

other chart query :

index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut) | timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name | addtotals fieldname=AvgTotalTrackoutTime