- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I am trying to use "table command" to list values which i have selected in multi-select input in dashboard.
where "Host" is value from multi select drop down of dashboard and "KPI" is value which is created by ..... | eval {counter}=Value.
below is query of panel which i am trying to Plot in horizon chart.
host=ABCD and DCBA
KPI=% Space Used and % Processor Time
eg:-
index="n_*1_idx" host IN ($host$)
| eval {counter}=Value | timechart span=5m avg($KPI$)
|table _time avg*
Note: the above query works fine, but as soon as i select second KPI in Multi-select input, Horizon chart does not show any data.
I want something like below:-
index="n_*1_idx" host IN ($host$)
| eval {counter}=Value | timechart span=5m avg($KPI$)
|table _time avg(% Space Used) avg(% Processor Time).
I would greatly appreciate any help. thanks in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

not sure if you actually need to table the fields after timechart, since timechart kinda does that already? If not, maybe change your multi-select input to build a token that contains all of the aggregates you need.
Token Value Prefix: avg(
Token Value Suffix: )
Delimiter: ,
and so now your KPI token will contain avg(kpi1), avg(kpi2),.. so you can then just
... | timechart span=5m $KPI$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

not sure if you actually need to table the fields after timechart, since timechart kinda does that already? If not, maybe change your multi-select input to build a token that contains all of the aggregates you need.
Token Value Prefix: avg(
Token Value Suffix: )
Delimiter: ,
and so now your KPI token will contain avg(kpi1), avg(kpi2),.. so you can then just
... | timechart span=5m $KPI$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@maciep, thanks for helping out. yes i did followed same and used Token Value prefix..
index="n_*1_idx" host IN ($host$)
| eval {counter}=Value | timechart span=5m avg($KPI$) avg($KPI1$) avg($KPI2$)
