Getting "Series filtering is disabled if a split-by field is used in conjunction with multiple data" warning

[tkadale]

I have shown time-chart for 2 fields. The Query is as follows:

timechart max(input_error) , max(output_error) by host

When this query runs, Graphs are displayed properly, but on the top a warning message is shown as follows:

Series filtering is disabled if a split-by field is used in conjunction with multiple data

How should I remove this warning??

Thanks in advance.

[hexx]

When you use timechart, you have to choose between using multiple aggregation functions and no split-by field (example : timechart span=1d max(input_error), max(output_error), avg(output_error)) or using a single aggregation function with a split-by field (example : timechart span=1h perc95(output_error)).

You cannot use multiple aggregation functions in conjunction with a split-by field.

What is happening for your search is that Splunk is dropping the "by host" split-by field and will show the values aggregated over all hosts for "max(input_error)" and "max(output_error)" as two data-point series on the graph, just as if you had run "timechart max(input_error), max(output_error)".

For more information on the syntax of timechart and to see examples of its usage, please refer to http://www.splunk.com/base/Documentation/latest/SearchReference/Timechart

[gkanapathy]

Here is how you would be able to work around the limitation described: http://www.splunk.com/base/Documentation/latest/User/ReportOfMultipleDataSeries