Chart Values Quesiton

[hastrike]

Is there a way to chart values(count) by more than two fields

[skoelpin]

...| chart count by field1, field2

[somesoni2]

You can create a field by concatenating multiple field and use that as second field in chart. E.g. show count of event over source by component and group

index=_internal sourcetype=splunkd | eval component=component.":".group | chart count over source by component