topic Re: merge timechart column in Splunk Search

merge timechart column

darksky21 — Sun, 17 Nov 2013 06:45:47 GMT

Hi i am using timechart count by source. It gave me a table:

_time cat dog  car
23/3   2   2    3
24/5   5   4    3

is there anyway to merge cat and dog into a single column like animal?

_time  animal  car
23/3      4     3
24/5      9     3

Thanks in advance

Re: merge timechart column

lguinn2 — Sun, 17 Nov 2013 07:00:10 GMT

Yes!

yoursearchhere
| eval source=if(source=="cat" OR source=="dog","animal",source)
| timechart count by source

Re: merge timechart column

ShaneNewman — Sun, 17 Nov 2013 07:05:31 GMT

Sure thing, you will have to evaluate a new field and use the chart command instead. If you want it by day you will need to add the bucket command. Something of this effect:

your search | eval animal=(cat+dog) | bucket span=1d _time | chart sum(animal) as animal, sum(car) as car by _time

Re: merge timechart column

darksky21 — Sun, 17 Nov 2013 09:32:55 GMT

thanks it works great