Splunk Search

How do you Timechart by multiple fields?

Esperteyu
Explorer

Hi,

I'm struggling with the below query "presentable" in a dashboard. Initially, my idea was to have time on the x-axis, and the count of events on the y-axis, and columns for each scheme stacking the countries (if that makes sense, I thought could be a viable visualization) but can't make it work although the search gives the correct values

index="my_index" base_search 
| rex field=_raw "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex field=_raw "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| stats count by country, scheme

Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

You have to create an aggregate field like this:

index="my_index" base_search 
| rex "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| eval country_scheme = country . ":" . scheme
| timechart count BY country_scheme

View solution in original post

woodcock
Esteemed Legend

You have to create an aggregate field like this:

index="my_index" base_search 
| rex "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| eval country_scheme = country . ":" . scheme
| timechart count BY country_scheme

rojyates
Explorer

An alternative to | eval country_scheme = country . ":" . scheme is to use strcat:

| strcat country ":" scheme country_scheme
| timechart count BY country_scheme
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...