split line graph

Dashboards & Visualizations

trying to get 2 different lines one for HDX and the other for RDP, can anyone help please?

Try replacing the last stats command with timechart.

| timechart count by protocol

---
If this reply helps you, Karma would be appreciated.

Try

| chart count by _time protocol

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register Is your ...

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

Join the Conversation