How do you Timechart by multiple fields?

[Esperteyu]

Hi,

I'm struggling with the below query "presentable" in a dashboard. Initially, my idea was to have time on the x-axis, and the count of events on the y-axis, and columns for each scheme stacking the countries (if that makes sense, I thought could be a viable visualization) but can't make it work although the search gives the correct values

index="my_index" base_search 
| rex field=_raw "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex field=_raw "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| stats count by country, scheme

Thanks

[woodcock · Accepted solution]

You have to create an aggregate field like this:

index="my_index" base_search 
| rex "\\\\\"country\\\\\":\\\\\"(?<country>\w+)\\\\\"" 
| rex "\\\\\"scheme\\\\\":\\\\\"(?<scheme>\w+)\\\\\"" 
| eval country_scheme = country . ":" . scheme
| timechart count BY country_scheme

[rojyates]

An alternative to | eval country_scheme = country . ":" . scheme is to use strcat:

| strcat country ":" scheme country_scheme
| timechart count BY country_scheme