Visualisation with multiple data

[Kaushaas]

Hi 

I am trying to get visualization in a way when i select multiple categories i see multiple lines in chart and when single value selected i need to get single line but unable to create chart when passing multiple values in categories Please help 

| rex field=message "MessageTemplate\\\":\\\"(?<msgType>[^\\\"]+)" | spath | search SAP OR TMD
|timechart count by SAP or TMD

Expecting result like below but this query gives error

| rex field=message "MessageTemplate\\\":\\\"(?<msgType>[^\\\"]+)" | spath | search SAP | timechart count . This is coming fine as I have timechart given by count 

Thanks in advance
Ashima

[ITWhisperer]

Assuming msgType extracts values such as SAP and TMD, try something like this

| rex field=message "MessageTemplate\\\":\\\"(?<msgType>[^\\\"]+)" | spath | search SAP OR TMD
|timechart count by msgType