Chart or timechart by multiple values

[sherpedz]

I have a chart that I can split by myDate or env, but I cannot get it to split by both myDate and env for example I need to see how many urgency events have taken place on a given myDate by each of the env (environments).

I have used multiple versions of splitting the code and just cannot get this right - any help will be great, this is related to Splunk ES.

`notable`
| eval env=coalesce(src_bunit, dvc_bunit, dest_bunit)
| eval env=upper(env)
| fillnull value="Unknown" env
| search NOT `suppression` AND env=*
| eval myDate=strftime(_time, "%Y-%m-%d")
| chart count by env urgency
| table myDate env critical high medium low informational
| fillnull critical high medium low informational
| rename env AS Environment, critical AS Critical, high AS High, medium AS Medium, low AS Low, informational AS Informational
| addtotals col=true labelfield=Environment label="Total(s)" row=true

[ITWhisperer]

chart loses myDate. Try using stats and then create a field with the name for the series and use that for the xyseries. Something like this:

`notable`
| eval env=coalesce(src_bunit, dvc_bunit, dest_bunit)
| eval env=if(like(env,"%tgw%") OR like(env,"%TGW%"),"DCT",env)
| eval env=upper(env)
| fillnull value="Unknown" env
| search NOT `suppression` AND env=*
| eval myDate=strftime(_time, "%Y-%m-%d")
| stats count by myDate env urgency
| eval envurgency=env.":".urgency
| xyseries myDate envurgency count