Splunk Search

How do you Timechart by multiple fields?

Esperteyu
Explorer

Hi,

I'm struggling with the below query "presentable" in a dashboard. Initially, my idea was to have time on the x-axis, and the count of events on the y-axis, and columns for each scheme stacking the countries (if that makes sense, I thought could be a viable visualization) but can't make it work although the search gives the correct values

index="my_index" base_search 
| rex field=_raw "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex field=_raw "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| stats count by country, scheme

Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

You have to create an aggregate field like this:

index="my_index" base_search 
| rex "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| eval country_scheme = country . ":" . scheme
| timechart count BY country_scheme

View solution in original post

woodcock
Esteemed Legend

You have to create an aggregate field like this:

index="my_index" base_search 
| rex "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| eval country_scheme = country . ":" . scheme
| timechart count BY country_scheme

rojyates
Explorer

An alternative to | eval country_scheme = country . ":" . scheme is to use strcat:

| strcat country ":" scheme country_scheme
| timechart count BY country_scheme
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...