Can you have 3 fields within a chart

[zoebanning]

Hi Splunk Community,

I was wondering if it was possible to have a chart that was made up from 3 fields.... 

I have already built a chart that has columns for each Account where each column is stacked with the Action -->  | chart count by Account, Action 

Can i break down into days using the _time field, so it counts by days?

Example of data:

_time	Account	Action
2021-10-20 10:04:03.778	account1	Delete
2021-10-21 11:04:03.778	account2	Write
2021-10-21 11:05:03.778	account1	Write

Thanks You,

Zoe 

[bhargavi · Accepted solution]

Hi @zoebanning ,

• Chart command does not allow more than 2 fields  in by clause
• Timechart command does not allow more than 1 field  in by clause
  
  So here I have tried to display the possible values of account and action and merged them into 1 column, then used timechart command . 
  
  

  If this helps, give a thumbs-up 🙂

  Happy Splunking!!

[NobliX]

Regarding the chart. Is there a possibility to hide or remove a column in the column chart based on nullvalue. (The space created visually) ? As of now it is created spaces to 3 bars, thus its only displaying the value of given instance.