Splunk transforming commands do not support a direct way to define multiple data series in your charts (or timecharts). However, you CAN achieve this using a combination of the stats and xyseries commands."
I've read that topic before, in previous Splunk versions, and have used the techniques it describes.
So, I'm curious: what is actually new about this item for 7.3? Does it refer to some new feature in SPL?
Or—noting the reference to, or qualification, metrics in that 7.3 "what's new" item—perhaps what's new here is a new feature in the Metrics Workspace, which generates SPL that uses the techniques in that "Build a chart of multiple data series"?
Confession: I dip in and out of Splunk every so often. I've read about metrics and the Metrics Workspace, but not yet used them. So far, I've only used events with SPL and Simple XML to develop dashboards.
This does not allow you to chart on multiple metric in single panel.
It only allows one metric per panel and it creates separate panel for each metric.
split by only allows to select dimension field for that also you can use only one dimension.
I am looking for to chart multiple metrics in a single panel.
I can do that using event data index but not with metrics index.
is there a way to do it?
Also metrics data index does not allow you to chart out of raw metric data. you have to use avg, max, min etc. mstat funtion.
is there a way for that too?
@Graham_Hannington I think you missed an very crucial part of information in the Splunk Documentation...
Co-analyze multiple related metrics as this feature is specifically for Metrics Index data through Metrics Workspace which comes pre-installed with 7.3. For prior 7x version you needed to install Metrics Workspace app separately from Splunkbase for this.
What you can try is suffix analysis_worspace in the URL besides your App and you should see Metrics work-space.