How to best approach timeseries graph based on multiple fields?

[AKG11]

Hi, 

I am looking to create timeseries graph based on multiple fields.
we could have multiple hosts and each host have multiple CPU. 
Looking best approach to visualize it.

Thanks

[ITWhisperer]

It depends on what you are trying to show!

You could use a trellis format, one tile for each host, or you could concatenate the host and cpu into a single field and display them all on one chart.

[AKG11]

@ITWhisperer  Thanks. I tried that but I am not be able to split by host.

Any idea ?

[ITWhisperer]

For trellis, you need to keep host and cpu separate - try something like this

| bin _time span=1m
| stats avg(value) as avg by _time host CPU

If you want them all on the same chart, then you concatenate host and cpu

[AKG11]

@ITWhisperer  I think it will be better to have separate graph for each host.

I tried what you suggested but it doesn't seems  like working.  Infact its not changing any thing in results. Am I missing something ?
basically in one chart it should show all CPU graph for single host.

[ITWhisperer · Accepted solution]

Try this

| bin _time span=1m
| stats avg(value) as avg by _time host cpu
| eval {cpu}=avg
| fields - avg cpu