Ok this has to be easy but for some reason I cant figure it out. I have a query that produces two sets of stats
23 5
45 7
19 2
I would like to see these numbers in a line chart as 2 lines with a single data point for each number. When I try to select line chart for the visualization by default it tries to pick the 1st set of numbers as the x axis. How do you just tell to graph the numbers
@a238574, For plotting two series on chart, you should also have aggregation field name as first first column i.e.
sno stats1 stats2
sno1 23 5
sno2 45 7
sno3 19 2
So you would ideally need to retain aggregation field name in your final result or need to create one. Please share your current query if you need us to look and correct the same. In order to create a new field one of the ways would be to use streamstats
<yourCurrentSearch>
| streamstats count as sno
| eval sno="sno".sno
| table sno <yourFirstStatsField> <yourSecondStatsField>
Following is the run anywhere search based on sample data provided.
| makeresults
| eval data="23,5;45,7;19,2"
| makemv data delim=";"
| mvexpand data
| makemv data delim=","
| eval stats1=mvindex(data,0),stats2=mvindex(data,1)
| fields - _time data
| streamstats count as sno
| eval sno="sno".sno
| table sno stats1 stats2
Please try out and confirm!
Hello,
If you try by this:
index=_internal | stats count sum(bytes) by version
And then select multiseries mode in formt of the chart
can you add information please?
thanks
Could you please share your search query (with sensitive data left out)? It will be much easier to help if we can see that.