I have below simple search query , would like to timechart nodename by date/time agaist "gbps", "uplink", "downlink".
index=xyz source=xyz* gbps OR uplink OR downlink OR nodename
Its function over time and gbps, uplink, downlink are numerics. Yes, need line for each node.
What do you want to use as your aggregation function or functions over time? Are gbps, uplink, downlink numerics? Do you want a line for each node name?
| timechart avg(gbps) as gbps, sum(uplink) as uplink, sum(downlink) as downlink by nodename span=1h