Dashboards & Visualizations

How can I combine two fields so that the labeling in one of the fields show up as one in the timechart visualization view?

pcnca
New Member

How can I combine two fields so that the labeling in the of the fields show up as one in the timechart visualization view?

i.e. from this searched Event, trying to combine “ hostname & port” , so that in the timechart it shows something like this ny9710c02_ fc2/23, currently I’ve been only able to get either one of these fields to display.

hostname = ny9710c02

port= fc2/23

" TXWait " source="SAN-45147" NOT *FALLING*| timechart count by hostname limit=10 

Time    Event
    7/23/19
3:01:19.778 PM  <43>2019-07-23T15:01:19.778405+00:00 ny9710c02.com 1.1.1.4 : 2019 Jul 23 11:01:19 EDT: %PMON-SLOT2-3-RISING_THRESHOLD_REACHED: TXWait has reached the rising threshold (port=fc2/23 [0x1096000], value=40) . 
0 Karma

vnravikumar
Champion

Hi

Try like

|eval hostname_port = hostname."_".port| timechart count by hostname_port limit=10
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...