Field values

[obularajud16]

•  

Ghj

sourcetype=access_combined | eval action = if(isnull(action) OR action="", "Unknown", action) | timechart span=40h  values(action),count(action)

[obularajud16 · Accepted solution]

Got the answer with the below

Spoiler

sourcetype=access_combined | eval action = if(isnull(action) OR action="", "unknown", action) | bin span=72h _time | stats count as totals by action, span(=_time,72h) | sort -_time,action​

[thambisetty]

sourcetype=access_combined 
| eval action = if(isnull(action) OR action="", "Unknown", action) 
| bin _time span=40h 
| chart count over _time by action

[to4kawa]

sourcetype=access_combined | eval action = if(isnull(action) OR action="", "Unknown", action) | timechart span=40h count by action

[obularajud16]

As I mentioned, i need data in row format not in column format to group by multiple fields

timechart span=40h count by action, status

[isoutamo]

Easiest way is combine those values like:

eval a_s = action . "-".status 

| timechart span=40h count by a_s

Otherwise you must start to play with bin + stats/chart/xyseries

r. Ismo