Hi everyone!
Here is my problem:
Thanks to a search, I have multiple lines on the same graph. But now, I want to merge them in a single line.
My search:
index="dashboards" Step=-1 | bucket _time span=1s | convert timeformat="%H:%M:%S" ctime(_time) AS date_lancement | chart values(Test) as res by date_lancement, AgentID
I create a chart which gives me two lines (because I have two different AgentID in this case), and the values(Test) gives me, for each of them, a number during the time (date_lancement).
So let's say those two lines are f(x) and g(x), I want to draw (f+g)(x).
Any idea? 😃
Thanks in advance,
nugetchar.
why not removing the AgentId field completely and display a timechart ?
index="dashboards" Step=-1 | timechart span=1s sum(Test) as res
Hi nugetchar
I hope I get you right; I think you will get what you want, if you change the formatting option for your chart to chart type area
and stack mode to stacked
.
hope this helps
cheers,
MuS