https://community.splunk.com/t5/Splunk-Search/timechart-fields/m-p/85950#M21933 <P>I feel so s......</P> <P>Thanks</P> Thu, 28 Jun 2012 13:06:47 GMT HansK 2012-06-28T13:06:47Z https://community.splunk.com/t5/Splunk-Search/timechart-fields/m-p/85948#M21931 <P>I'm trying to create a chart based on this data, the Num field changes every day:</P> <P>2012-06-28 13:57:48 operator=TLFT Num=10489</P> <P>2012-06-28 13:57:48 operator=ORIN Num=15</P> <P>2012-06-28 13:57:48 operator=CLWV Num=649</P> <P>2012-06-28 13:57:48 operator=HILF Num=285</P> <P>Everything I do just counts the occurences of operator, but I would like it to use the Num field, so have a line for operator and over time show the Num field.</P> Thu, 28 Jun 2012 12:52:18 GMT https://community.splunk.com/t5/Splunk-Search/timechart-fields/m-p/85948#M21931 HansK 2012-06-28T12:52:18Z https://community.splunk.com/t5/Splunk-Search/timechart-fields/m-p/85949#M21932 <P>Have you tried<BR /> <PRE><CODE><BR /> ... | timechart span=1d values(Num) by operator<BR /> </CODE></PRE></P> Thu, 28 Jun 2012 13:01:10 GMT https://community.splunk.com/t5/Splunk-Search/timechart-fields/m-p/85949#M21932 cphair 2012-06-28T13:01:10Z https://community.splunk.com/t5/Splunk-Search/timechart-fields/m-p/85950#M21933 <P>I feel so s......</P> <P>Thanks</P> Thu, 28 Jun 2012 13:06:47 GMT https://community.splunk.com/t5/Splunk-Search/timechart-fields/m-p/85950#M21933 HansK 2012-06-28T13:06:47Z https://community.splunk.com/t5/Splunk-Search/timechart-fields/m-p/85951#M21934 <P>No problem, @HansK. Could you click the checkmark to accept the answer?</P> Thu, 28 Jun 2012 13:30:36 GMT https://community.splunk.com/t5/Splunk-Search/timechart-fields/m-p/85951#M21934 cphair 2012-06-28T13:30:36Z