I've set up several eventtypes with the same tag. I'm now trying to use timechart but getting unexpected NULL eventtype.
host="production" tag="mytag" | timechart span=1w count by eventtype
Somehow this is coming back with a NULL eventtype, despite the search alone returning as expected. All of the eventtypes start with the same word (e.g. "myevent_100", "myevent_101", etc.) so I also tried this and get the same strange NULL on the timechart:
host="production" eventtype="myevent*" | timechart span=1w count by eventtype