Combine timechart in one chart by fields.

juanvarelagloba — Tue, 23 Jun 2015 18:49:37 GMT

I have this query:

index=betas host="*433*" level=ERROR 
(source="*RequestUpg*" class="*RequestUpgEndPoint*") OR 
(source="*DisplayUpgPassengerItineraries*" class="*DisplayUpgPassengerItinerariesEndPoint*") OR 
(source="*ApiUpg*" 
    class="*GetCustomersService*" OR 
    class="*ItineraryService*" OR 
    class="*RequestUpgService*" OR 
    class="*GetCustomersController*" OR
    class="*AuthenticationServiceFilter*")

| timechart span=1d count by class

It does exactly what I want except it produces several charts:

I want it to produce one chart with this exact labels altogether in one chart, how should I approach it?

Re: Combine timechart in one chart by fields.

martin_mueller — Tue, 23 Jun 2015 19:13:12 GMT

Click the format button above the charts and toggle the multi-series mode.

Re: Combine timechart in one chart by fields.

juanvarelagloba — Tue, 23 Jun 2015 19:16:02 GMT

I feel silly now 😕 Thanks a bunch!

topic Re: Combine timechart in one chart by fields. in Splunk Search

Combine timechart in one chart by fields.

Re: Combine timechart in one chart by fields.

Re: Combine timechart in one chart by fields.