split line graph

Dashboards & Visualizations

trying to get 2 different lines one for HDX and the other for RDP, can anyone help please?

Try replacing the last stats command with timechart.

| timechart count by protocol

---
If this reply helps you, Karma would be appreciated.

Try

| chart count by _time protocol

Get Updates on the Splunk Community!

The updated Splunk Add-on for Microsoft Windows helps customers search Windows events faster by reducing ...

Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or ...

As AI agents take on more complex tasks, teams need greater visibility into how they behave, what they cost, ...

Join the Conversation