Instead, I wanna do as below
test.csv
devicetype
router
switch
firewall
sysproxy
webproxy
I would like to create a timeseries dashboard based on devicetype in different charts
router
GRAPH
Switch
GRAPH
Firewall
GRAPH
Create a chart panel in your dashboard with this query
|inputlookup test.csv | bin span=1h nameforfieldwithtimestampinyourcsv | chart count by nameforfieldwithtimestampinyourcsv devicetype
Click the paintbrush icon for this dashboard panel, and select multiseries mode. This will show each devicetype separatel. You can increase the height of the chart panel, by editing the source to include (pick appropriate number)
<option name="height")300</option>
*UPDATED* based on feedback
You have couple of options. First, you can create a multi-series panel, like described above, using this query
index=xyz [|inputlookup test.csv | rename devicetype AS name | fields name ] | timechart values(lograte) as lograte by name
OR create three separate panels, with each for specific devicetype using this query for panel where devicetype is router (change the name= part for each panel`
index=xyz name="router" | timechart values(lograte) as lograte
Hi ,
test.csv
router
firewall
switch
indexed data:
name=router lograte=20
name=switch lograte=30
name=firewall lograte=40
i would like to plot the lograte per each name in timeseries . I would like to see 3 timeseries graphs based on the name
What data do you want to plot for each device type?
based my devicetype .. i would like to look for number of devices logging or number of critical alerts.
-pa1