Splunk Search

Chart with time grouping and multiple fields

harshal_chakran
Builder

Hi,
Iam trying to build the chart as below:
alt text

Here I am having two fields as X-Axis (one is Parameter and other is time)
Is there any way I could build this chart? I am using timechart with span of month to group but cant display Parameter.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

I don't know if it's acceptable For you but, using eval command, you could build a new field that contains the other two and then chart by the new field:
It's important to Group events with the bin commands befote charting.
Something like this
Mysearch | bin span=1mon _time | eval column=_time+myfield | chart count by column
Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

I don't know if it's acceptable For you but, using eval command, you could build a new field that contains the other two and then chart by the new field:
It's important to Group events with the bin commands befote charting.
Something like this
Mysearch | bin span=1mon _time | eval column=_time+myfield | chart count by column
Bye.
Giuseppe

0 Karma

harshal_chakran
Builder

Thanks Cusello, thanks for the anwser.
I am good to go with newly formed axis labes like- Param1 Jan16, Param2 Jan16...Param1 Feb16, Param2 Feb16...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Introducing ITSI 5.0: Unified Visibility and Actionable Insights Tuesday, July 21, 2026  |  10:00AM PT / ...

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

Inside Splunk Agent Observability:Understanding Agent Behavior, Tokens & Costs Thursday, August 06, ...

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...