Line Chart over _time by fieldname

[ips_mandar]

Hi I am trying below query to plot line chart-

index=abc |eval Time=round(endtime-starttime)|chart values(Time) as Time over _time by Type

Here there can be multiple Type values.
my problem is some _time field has multivalue Time field due to which it is not plotted on graph and I am not able to use mvexpand on Type because Type value is not fixed .
my output looks like below

_time                                     Build
29/01/2019 12:01                            2
                                            3
                                            4
29/01/2019 12:12                            5

from above only 5 value is getting plotted and others are not seen due to multivalue and here I can not apply mvexpand Build as this value can change

[jkat54]

Try the stats command instead

index=abc |eval Time=round(endtime-starttime)|stats values(Time) as Time by _time Type

[ips_mandar]

Thanks for comment @jkat54
but if I try this |stats values(Time) as Time by _time Type|mvexpand Time
i will get below result

 _time                                     Type                              Time
  29/01/2019 12:01                         Build                              2
  29/01/2019 12:01                         Build                              3                  
  29/01/2019 12:01                         Build                              4                  
  29/01/2019 12:12                         Build                              5              

and If i plot line chart it will have legend as Time and Type instaead of value of Type i.e. Build
I want result as-

 _time                                     Build
  29/01/2019 12:01                            2
  29/01/2019 12:01                            3
  29/01/2019 12:01                            4
  29/01/2019 12:12                            5

[DMohn]

add a |rename Time as Build | fields -Type and you will get your desired result

[ips_mandar]

here for example I shown Build but there can be Build and Deploy under Type

[harishalipaka]

hi @ips_mandar
i didn't understand what do u want ,i can't see above example Type

Can u explain what u had and what do u want simply

[ips_mandar]

So Type is fieldname and it's value can be Build or Deploy or both.
After Running this query-

index=abc |eval Time=round(endtime-starttime)|chart values(Time) as Time over _time by Type

I got below results-

_time                                     Build
 29/01/2019 12:01                            2
                                             3
                                             4
 29/01/2019 12:12                            5

But I want to have seggregated result like

_time                                     Build
 29/01/2019 12:01                            2
 29/01/2019 12:01                            3
 29/01/2019 12:01                            4
 29/01/2019 12:12                            5

This can be achieved using mvexpand Build but Build value is not fixed. so is there any other way..

[DMohn]

Have you tried using |filldown _time ??

[ips_mandar]

thnks @DMohn but it won't help