How to show a subset of all keys in a chart?

[neilmac64]

I am ingesting data from multiple end points. The data is about 30key/value pairs. I would like to be able to chart just a subset of the keys.

At the moment, I have a chart that has a drop down list to select the endpoint I want to display (identified by mac address).

Right now, my search is as follows:

index=index
mac_address=$mac_address$ | timechart span=15m values(value) by key

This returns a graph with every single key/value pair on it.  I'd like to edit the search just to show specific values.

I note I don't have a source/sourcetype specified (I wasn't sure if I needed this).

I've also tried to search for specific fields using the avg command but this returns no values:

index=index
mac_address=$mac_address$ | timechart span=15m avg(key_1) as "key_1" avg(key_2) as "key_2"

As always, any help very much appreciated.

NM

[neilmac64]

OK, I have now something that looks like what I need. The search I now have is:

index=index
mac_address=$mac_address$ key=key_1 OR key=key_2 | timechart span=15m values(value) by key

I'm going to play some more and see if this scales to the other charts I need. I'll let you know how it looks.

NM

[ITWhisperer]

If you know the values of the keys you want to keep, e.g. key_1 and key_2, just include them on a fields command

index=index
mac_address=$mac_address$ | timechart span=15m values(value) by key
| fields _time key_1 key_2

[neilmac64]

Thank you for the very quick reply.

As amended, that search does not show any results:

index=index
mac_address=$mac_address$ | timechart span=15m values(value) by key
| fields _time key_1 key_2

What else could I try?

[ITWhisperer]

Perhaps you could share the stats table you got as a result?

The values(value) part of the timechart will create multivalue fields and if there is more than one value in the field, it can't be displayed on the column chart (which value should be represented)?