Splunk Search

Chart with time grouping and multiple fields

harshal_chakran
Builder

Hi,
Iam trying to build the chart as below:
alt text

Here I am having two fields as X-Axis (one is Parameter and other is time)
Is there any way I could build this chart? I am using timechart with span of month to group but cant display Parameter.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

I don't know if it's acceptable For you but, using eval command, you could build a new field that contains the other two and then chart by the new field:
It's important to Group events with the bin commands befote charting.
Something like this
Mysearch | bin span=1mon _time | eval column=_time+myfield | chart count by column
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

I don't know if it's acceptable For you but, using eval command, you could build a new field that contains the other two and then chart by the new field:
It's important to Group events with the bin commands befote charting.
Something like this
Mysearch | bin span=1mon _time | eval column=_time+myfield | chart count by column
Bye.
Giuseppe

0 Karma

harshal_chakran
Builder

Thanks Cusello, thanks for the anwser.
I am good to go with newly formed axis labes like- Param1 Jan16, Param2 Jan16...Param1 Feb16, Param2 Feb16...

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...