https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-chart-so-each-data-point-shows-three-field/m-p/259926#M77921 <P>Concatenation makes it look a little long and messy but should work fine. Thanks!</P> Thu, 01 Dec 2016 18:53:37 GMT byu168168 2016-12-01T18:53:37Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-chart-so-each-data-point-shows-three-field/m-p/259924#M77919 <P>I generated a line chart and am plotting on two fields: Time and ID, however, I want to see more than just these two fields. Is there a way to generate a chart so that each point on the line chart shows three field values: Time, ID, and Name?</P> Thu, 01 Dec 2016 17:43:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-chart-so-each-data-point-shows-three-field/m-p/259924#M77919 byu168168 2016-12-01T17:43:55Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-chart-so-each-data-point-shows-three-field/m-p/259925#M77920 <P>Line charts are designed for plotting two values on a axis. If it makes sense, you can concatenate the ID and Name into one field and plot that over time.</P> <PRE><CODE>&lt;your search&gt; | eval NameID=Name+":"+ID | timechart values(NameID) </CODE></PRE> Thu, 01 Dec 2016 18:46:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-chart-so-each-data-point-shows-three-field/m-p/259925#M77920 jimodonald 2016-12-01T18:46:04Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-chart-so-each-data-point-shows-three-field/m-p/259926#M77921 <P>Concatenation makes it look a little long and messy but should work fine. Thanks!</P> Thu, 01 Dec 2016 18:53:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-line-chart-so-each-data-point-shows-three-field/m-p/259926#M77921 byu168168 2016-12-01T18:53:37Z