Instead, I wanna do as below
test.csv
devicetype
router
switch
firewall
sysproxy
webproxy
I would like to create a timeseries dashboard based on devicetype in different charts
router
GRAPH
Switch
GRAPH
Firewall
GRAPH
Create a chart
panel in your dashboard with this query
|inputlookup test.csv | bin span=1h nameforfieldwithtimestampinyourcsv | chart count by nameforfieldwithtimestampinyourcsv devicetype
Click the paintbrush
icon for this dashboard panel, and select multiseries mode
. This will show each devicetype separatel. You can increase the height of the chart
panel, by editing the source to include (pick appropriate number)
<option name="height")300</option>
*UPDATED* based on feedback
You have couple of options. First, you can create a multi-series panel, like described above, using this query
index=xyz [|inputlookup test.csv | rename devicetype AS name | fields name ] | timechart values(lograte) as lograte by name
OR create three separate panels, with each for specific devicetype using this query for panel where devicetype is router (change the name=
part for each panel`
index=xyz name="router" | timechart values(lograte) as lograte
Hi ,
test.csv
router
firewall
switch
indexed data:
name=router lograte=20
name=switch lograte=30
name=firewall lograte=40
i would like to plot the lograte per each name in timeseries . I would like to see 3 timeseries graphs based on the name
What data do you want to plot for each device type?
based my devicetype .. i would like to look for number of devices logging or number of critical alerts.
-pa1