<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Chart with time grouping and multiple fields in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Chart-with-time-grouping-and-multiple-fields/m-p/214348#M62850</link>
    <description>&lt;P&gt;I don't know if it's acceptable For you but, using eval command, you could build a new field that contains the other two and then chart by the new field:&lt;BR /&gt;
It's important to Group events with the bin commands befote charting.&lt;BR /&gt;
Something like this&lt;BR /&gt;
Mysearch | bin span=1mon _time | eval column=_time+myfield | chart count by column&lt;BR /&gt;
Bye.&lt;BR /&gt;
Giuseppe &lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 11:13:16 GMT</pubDate>
    <dc:creator>gcusello</dc:creator>
    <dc:date>2020-09-29T11:13:16Z</dc:date>
    <item>
      <title>Chart with time grouping and multiple fields</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Chart-with-time-grouping-and-multiple-fields/m-p/214347#M62849</link>
      <description>&lt;P&gt;Hi,&lt;BR /&gt;
Iam trying to build the chart as below:&lt;BR /&gt;
&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/1911i226FE903EE2A20C2/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;Here I am having two fields as X-Axis (one is Parameter and other is time)&lt;BR /&gt;
Is there any way I could build this chart? I am using timechart with span of month to group but cant display Parameter.&lt;/P&gt;</description>
      <pubDate>Tue, 27 Sep 2016 07:02:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Chart-with-time-grouping-and-multiple-fields/m-p/214347#M62849</guid>
      <dc:creator>harshal_chakran</dc:creator>
      <dc:date>2016-09-27T07:02:48Z</dc:date>
    </item>
    <item>
      <title>Re: Chart with time grouping and multiple fields</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Chart-with-time-grouping-and-multiple-fields/m-p/214348#M62850</link>
      <description>&lt;P&gt;I don't know if it's acceptable For you but, using eval command, you could build a new field that contains the other two and then chart by the new field:&lt;BR /&gt;
It's important to Group events with the bin commands befote charting.&lt;BR /&gt;
Something like this&lt;BR /&gt;
Mysearch | bin span=1mon _time | eval column=_time+myfield | chart count by column&lt;BR /&gt;
Bye.&lt;BR /&gt;
Giuseppe &lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 11:13:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Chart-with-time-grouping-and-multiple-fields/m-p/214348#M62850</guid>
      <dc:creator>gcusello</dc:creator>
      <dc:date>2020-09-29T11:13:16Z</dc:date>
    </item>
    <item>
      <title>Re: Chart with time grouping and multiple fields</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Chart-with-time-grouping-and-multiple-fields/m-p/214349#M62851</link>
      <description>&lt;P&gt;Thanks Cusello, thanks for the anwser.&lt;BR /&gt;
I am good to go with newly formed axis labes like- Param1 Jan16, Param2 Jan16...Param1 Feb16, Param2 Feb16...&lt;/P&gt;</description>
      <pubDate>Mon, 10 Oct 2016 06:11:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Chart-with-time-grouping-and-multiple-fields/m-p/214349#M62851</guid>
      <dc:creator>harshal_chakran</dc:creator>
      <dc:date>2016-10-10T06:11:21Z</dc:date>
    </item>
  </channel>
</rss>

