Display time chart grouping by 2 fields

[RemyaT]

I have a Splunk query that helps me to visualize different APIs vs Time as below. Using this query I could see each line graph for each APIs in the given time.

index=sample_index 
|timechart span=1m count by API

  My actual requirement is to get the count by 2 fields (API and Consumer). ie I need a time graph for each API and Consumer combination.

One graph for API1_Consumer1, one for API1_Consumer2, and one for API2_Consumer3 like that. How can I achieve that?

[RemyaT]

Exactly what I wanted. Thanks bunch Daniel.

[danspav · Accepted solution]

Hi @RemyaT,

If you would like a single line graph with a line for each API/Consumer combo you could do the following:

| fillnull API, Consumer value="(blank)"
| eval API_Consumer = API . " - " . Consumer
| timechart span=1m count by API_Consumer

 
Here we're creating a new field called "API_Consumer" that will simply have the values for the API and Consumer separated by a hyphen: " - "

When the graph is created, you will have 1 line for each unique combo of API and Consumer fields. 

If any API or Consumer are blank, we change them to the value "(blank)" - you can change this or remove it if it's not needed in your case. 

If you want a separate graph per API-Consumer pair, you can choose a line graph and use Trellis mode:

When you split by API_Consumer, it will create one graph per API-Consumer pair (up to a max of 20 pairs)

Hope that helps,
Cheers,
Daniel