Display timechart "BY" multiple lines in one chart

[royimad]

I have a search with a timechart grouped by a fieldname that would like to displayed on a multilines chart on the same graph, How i can do that?

host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory" 
| where MESSAGE like "%Low Power%" 
| rex field=MESSAGE "Power :(?<Voltage>.{5})" 
| timechart span=1d eval(min(LowVolt)) as LowVoltage by DEVICE

[lguinn2 · Accepted solution]

I am not sure why you need the eval. Does the following work?

host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory" 
| where MESSAGE like "%Low Power%" 
| rex field=MESSAGE "Power :(?<Voltage>.{5})" 
| timechart span=1d min(LowVolt) as LowVoltage by DEVICE