https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94591#M24415 <P>Uh...well yes. That's kind of basic search filtering functionality. If you're unsure about those kind of things I advise you to take the Splunk tutorial.</P> Mon, 15 Jul 2013 12:49:21 GMT Ayn 2013-07-15T12:49:21Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94581#M24405 <P>I am using a search command of sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(type) as Incident count(current_summary) as Rain.</P> <P>I had current_summary and type, which I needed only the Rain from current_summary and Accident from type in both sources using the search query. Anyway I can do it ?</P> <P><IMG src="http://splunk-base.splunk.com//storage/Untitledtweayher_1.png" alt="alt text" /></P> <P><IMG src="http://splunk-base.splunk.com//storage/Untitledtraffic_1.png" alt="alt text" /></P> Mon, 28 Sep 2020 14:20:20 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94581#M24405 sbnoobbb 2020-09-28T14:20:20Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94582#M24406 <P>xmlkv is used for performing field extraction on certain XML formatted data. Not sure how it would be relevant in your scenario.</P> Mon, 15 Jul 2013 08:12:04 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94582#M24406 Ayn 2013-07-15T08:12:04Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94583#M24407 <P>I have edited the question. Check it out <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span></P> Mon, 15 Jul 2013 08:40:02 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94583#M24407 sbnoobbb 2013-07-15T08:40:02Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94584#M24408 <P>OK, but I have no idea what your desired result is (same issue as in your partner's more or less identical question). What exactly are you trying to do? What is the desired end result?</P> Mon, 15 Jul 2013 09:09:49 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94584#M24408 Ayn 2013-07-15T09:09:49Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94585#M24409 <P>I wanted to do a search for Rain and Accident on a timechart showing how rain affects more accidents (correlation of weather and traffic accidents). However the Accident is in Type and Rain is in current_summary. I need to do a count for number of times it rains on a specific location then count for accidents on the same location then plot it on a timechart.</P> Mon, 15 Jul 2013 09:56:04 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94585#M24409 sbnoobbb 2013-07-15T09:56:04Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94586#M24410 <P>So the desired result would be a graph with two lines - one for occurrences of rain and one for occurrences of accidents?</P> Mon, 15 Jul 2013 10:16:03 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94586#M24410 Ayn 2013-07-15T10:16:03Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94587#M24411 <P>Yes ! Against the same location !</P> Mon, 15 Jul 2013 11:22:50 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94587#M24411 kailun92 2013-07-15T11:22:50Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94588#M24412 <P>Did you read the timechart docs? You can specify which field values you are interested in using eval statements. So something like this should work:</P> <PRE><CODE>sourcetype=CurrentWeatherSGMap OR sourcetype=ltaTraffic | timechart count(eval(type=="Accident")) as Incident, count(eval(current_summary=="Rain")) as Rain </CODE></PRE> Mon, 15 Jul 2013 12:33:03 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94588#M24412 Ayn 2013-07-15T12:33:03Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94589#M24413 <P>What if i got another field called location and I need the location of "PIE" for example? Only display result for PIE, how can i do that ? Put at by location=PIE ?</P> Mon, 15 Jul 2013 12:39:17 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94589#M24413 kailun92 2013-07-15T12:39:17Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94590#M24414 <P>Consider that both sourcetype have these location fields extracted.</P> Mon, 15 Jul 2013 12:42:01 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94590#M24414 kailun92 2013-07-15T12:42:01Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94591#M24415 <P>Uh...well yes. That's kind of basic search filtering functionality. If you're unsure about those kind of things I advise you to take the Splunk tutorial.</P> Mon, 15 Jul 2013 12:49:21 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94591#M24415 Ayn 2013-07-15T12:49:21Z https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94592#M24416 <P>Kk, i am just double checking <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span> I am only not sure about the two sourcetype. Thanks ! Eval is what i needed <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span></P> Mon, 15 Jul 2013 12:57:53 GMT https://community.splunk.com/t5/Splunk-Search/Select-my-extracted-fields-for-correlation-in-timechart/m-p/94592#M24416 kailun92 2013-07-15T12:57:53Z