https://community.splunk.com/t5/Splunk-Search/timechart-where-field-name-and-value-are-both-in-event-data/m-p/292577#M88319 <P>See I knew it was going to be something simple. I just had to flip my thinking. Thank you so much that's exactly what I wanted!! </P> Thu, 09 Feb 2017 17:40:53 GMT kmaron 2017-02-09T17:40:53Z https://community.splunk.com/t5/Splunk-Search/timechart-where-field-name-and-value-are-both-in-event-data/m-p/292574#M88316 <P>I have a database query that runs every 5 minutes. It brings back queue names and the counts of those queues. I would like to make a timechart that would show all of the queues and their counts over time. </P> <P>My data comes out like this:</P> <P>2017-02-09 10:51:30 QUEUE="LIFE_UpdatePolicySecurity", LIFE_QUEUE_COUNT="5" <BR /> 2017-02-09 10:51:30 QUEUE="LIFE_UpdateAnnuitySecurity", LIFE_QUEUE_COUNT="38" <BR /> 2017-02-09 10:51:30 QUEUE="Policy File Document", LIFE_QUEUE_COUNT="3" <BR /> 2017-02-09 10:51:30 QUEUE="Annuity File Document", LIFE_QUEUE_COUNT="25" </P> <P>I would like to eventually end up with a line graph that would have a line or each queue name and show the count for each over time but I'm struggling to get the stats to line up to get it there. </P> Tue, 29 Sep 2020 12:49:08 GMT https://community.splunk.com/t5/Splunk-Search/timechart-where-field-name-and-value-are-both-in-event-data/m-p/292574#M88316 kmaron 2020-09-29T12:49:08Z https://community.splunk.com/t5/Splunk-Search/timechart-where-field-name-and-value-are-both-in-event-data/m-p/292575#M88317 <P>Have you tried <CODE>... | timechart max(LIFE_QUEUE_COUNT) by QUEUE</CODE> ?</P> Thu, 09 Feb 2017 16:24:35 GMT https://community.splunk.com/t5/Splunk-Search/timechart-where-field-name-and-value-are-both-in-event-data/m-p/292575#M88317 richgalloway 2017-02-09T16:24:35Z https://community.splunk.com/t5/Splunk-Search/timechart-where-field-name-and-value-are-both-in-event-data/m-p/292576#M88318 <P>If you've 10 or more distinct QUEUEs, then add limit=0 ( or any feasible number) so that there is a line for every queue.</P> Thu, 09 Feb 2017 16:53:18 GMT https://community.splunk.com/t5/Splunk-Search/timechart-where-field-name-and-value-are-both-in-event-data/m-p/292576#M88318 somesoni2 2017-02-09T16:53:18Z https://community.splunk.com/t5/Splunk-Search/timechart-where-field-name-and-value-are-both-in-event-data/m-p/292577#M88319 <P>See I knew it was going to be something simple. I just had to flip my thinking. Thank you so much that's exactly what I wanted!! </P> Thu, 09 Feb 2017 17:40:53 GMT https://community.splunk.com/t5/Splunk-Search/timechart-where-field-name-and-value-are-both-in-event-data/m-p/292577#M88319 kmaron 2017-02-09T17:40:53Z