Getting Data In

Display timechart "BY" multiple lines in one chart

Builder

I have a search with a timechart grouped by a fieldname that would like to displayed on a multilines chart on the same graph, How i can do that?

host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory" 
| where MESSAGE like "%Low Power%" 
| rex field=MESSAGE "Power :(?<Voltage>.{5})" 
| timechart span=1d eval(min(LowVolt)) as LowVoltage by DEVICE
Tags (2)
0 Karma
1 Solution

Legend

I am not sure why you need the eval. Does the following work?

host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory" 
| where MESSAGE like "%Low Power%" 
| rex field=MESSAGE "Power :(?<Voltage>.{5})" 
| timechart span=1d min(LowVolt) as LowVoltage by DEVICE

View solution in original post

Legend

I am not sure why you need the eval. Does the following work?

host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory" 
| where MESSAGE like "%Low Power%" 
| rex field=MESSAGE "Power :(?<Voltage>.{5})" 
| timechart span=1d min(LowVolt) as LowVoltage by DEVICE

View solution in original post