https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119872#M32167 <P>span is not working with chart. But I tried something below which works for me<BR /> chart perc90(s), count(s) by host</P> Thu, 09 Jul 2015 16:24:43 GMT asifpasha23 2015-07-09T16:24:43Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119864#M32159 <P>I am trying to create a timechart by 2 fields<BR /> Here is what I tried:<BR /> source=abc CounterName="\Process(System)\% Processor Time"| timechart span=1h avg(CounterValue) by RoleInstance CounterName</P> <P>Any idea how this could be achieved?</P> Thu, 03 Apr 2014 19:32:27 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119864#M32159 Gulrez 2014-04-03T19:32:27Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119865#M32160 <P>You can concat both the fields into one field and do a timechart on that.</P> Thu, 03 Apr 2014 19:38:56 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119865#M32160 somesoni2 2014-04-03T19:38:56Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119866#M32161 <P>Something like this</P> <PRE><CODE>source=abc CounterName="\Process(System)\% Processor Time" | eval Role_Counter=RoleInstance + "#" + CounterName| timechart span=1h avg(CounterValue) by Role_Counter </CODE></PRE> Thu, 03 Apr 2014 19:43:03 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119866#M32161 somesoni2 2014-04-03T19:43:03Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119867#M32162 <P>or bucket _time span=1h|chart avg(CounterValue) by RoleInstance,CounterName</P> Thu, 03 Apr 2014 20:29:46 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119867#M32162 linu1988 2014-04-03T20:29:46Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119868#M32163 <P>Can we scale this to more than 2 fields?</P> Thu, 03 Apr 2014 22:30:18 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119868#M32163 Gulrez 2014-04-03T22:30:18Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119869#M32164 <P>Time chart just work with one field in "by" clause. You can concatenate multiple field into one and use in timechart.</P> Fri, 04 Apr 2014 13:02:12 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119869#M32164 somesoni2 2014-04-04T13:02:12Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119870#M32165 <P>chart does support more fields. why to limit urself with timechart. They almost do the same.</P> Sat, 05 Apr 2014 07:23:42 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119870#M32165 linu1988 2014-04-05T07:23:42Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119871#M32166 <P>timechart values(foo) by bar <BR /> Is the same like <BR /> chart values(foo) over_time by bar<BR /> But like linu said chart can have more then one by clause</P> Sat, 05 Apr 2014 18:14:31 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119871#M32166 MuS 2014-04-05T18:14:31Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119872#M32167 <P>span is not working with chart. But I tried something below which works for me<BR /> chart perc90(s), count(s) by host</P> Thu, 09 Jul 2015 16:24:43 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119872#M32167 asifpasha23 2015-07-09T16:24:43Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119873#M32168 <P>This is an older one - but for reference:</P> <P>I don't think, that this is completely true. <CODE>chart</CODE> can have a and a . It's more flexible than <CODE>timechart</CODE> as the can be something other than <CODE>_time</CODE>. But you only have these to split-options (I believe, it was the same in 2014 with version 6.0.# or older).</P> <P>If I'm wrong, just tell me so I can learn more and more...</P> Wed, 25 Apr 2018 20:02:40 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119873#M32168 rvany 2018-04-25T20:02:40Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119874#M32169 <P>You can use the following and view the visualization tab </P> <P>|stats count by field1,field2</P> Thu, 12 Jul 2018 04:42:00 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119874#M32169 shahab1khan 2018-07-12T04:42:00Z https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119875#M32170 <P>how about </P> <P>source=abc CounterName="\Process(System)\% Processor Time" | stas count by RoleInstance,CounterName</P> <P>view the visualization tab to get charts afterwards</P> Thu, 12 Jul 2018 04:43:57 GMT https://community.splunk.com/t5/Splunk-Search/TimeChart-by-2-fields/m-p/119875#M32170 shahab1khan 2018-07-12T04:43:57Z