Dashboards & Visualizations

How can I combine two fields so that the labeling in one of the fields show up as one in the timechart visualization view?

pcnca
New Member

How can I combine two fields so that the labeling in the of the fields show up as one in the timechart visualization view?

i.e. from this searched Event, trying to combine “ hostname & port” , so that in the timechart it shows something like this ny9710c02_ fc2/23, currently I’ve been only able to get either one of these fields to display.

hostname = ny9710c02

port= fc2/23

" TXWait " source="SAN-45147" NOT *FALLING*| timechart count by hostname limit=10 

Time    Event
    7/23/19
3:01:19.778 PM  <43>2019-07-23T15:01:19.778405+00:00 ny9710c02.com 1.1.1.4 : 2019 Jul 23 11:01:19 EDT: %PMON-SLOT2-3-RISING_THRESHOLD_REACHED: TXWait has reached the rising threshold (port=fc2/23 [0x1096000], value=40) . 
0 Karma

vnravikumar
Champion

Hi

Try like

|eval hostname_port = hostname."_".port| timechart count by hostname_port limit=10
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...