https://community.splunk.com/t5/Splunk-Search/how-to-use-multiple-fields-in-timechart-command/m-p/159162#M44902 <P>As an fast solution you might combine the two fields into one field with eval and use the result as by clause:</P> <P>index=_internal | eval combi=source."#".sourcetype | timechart count by combi</P> Mon, 28 Jul 2014 11:04:46 GMT tom_frotscher 2014-07-28T11:04:46Z https://community.splunk.com/t5/Splunk-Search/how-to-use-multiple-fields-in-timechart-command/m-p/159161#M44901 <P>Hi All,</P> <P>How to use </P> <P>index="*"|timechart count by sourcetype,source</P> Mon, 28 Jul 2014 10:51:20 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-multiple-fields-in-timechart-command/m-p/159161#M44901 mvaradarajam 2014-07-28T10:51:20Z https://community.splunk.com/t5/Splunk-Search/how-to-use-multiple-fields-in-timechart-command/m-p/159162#M44902 <P>As an fast solution you might combine the two fields into one field with eval and use the result as by clause:</P> <P>index=_internal | eval combi=source."#".sourcetype | timechart count by combi</P> Mon, 28 Jul 2014 11:04:46 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-multiple-fields-in-timechart-command/m-p/159162#M44902 tom_frotscher 2014-07-28T11:04:46Z https://community.splunk.com/t5/Splunk-Search/how-to-use-multiple-fields-in-timechart-command/m-p/159163#M44903 <P>I don't know what exactly you want to know. There are examples for inpage drilldowns in the splunk 6.1 overview app. <A href="https://apps.splunk.com/app/1773/">https://apps.splunk.com/app/1773/</A></P> <P>You should be able to take the combi field as a normal token. If you want to split it up again in source and sourcetype, you can use the rex command:</P> <PRE><CODE>index=_internal | eval combi=source."#".sourcetype | rex field=combi "(?&lt;first_part&gt;^.*)#(?&lt;second_part&gt;.*$)" </CODE></PRE> Mon, 28 Jul 2014 11:49:38 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-multiple-fields-in-timechart-command/m-p/159163#M44903 tom_frotscher 2014-07-28T11:49:38Z