How to chart multiple fields by date?

[RB5]

Although I get a lot of hits for these keywords, I'm not having much luck finding a solution. Have tried timechart also.

I have: search... | chart sum(count) AS Total over DIRECTION by ATTACH (I was also using 'addtotals' for that which was a nice feature)

to get below:

DIRECTION | HAS_ATTACH | NO_ATTACH

Inbound | 2491 | 338

Outbound | 568 | 2792

But I also want the date, but not in this format: | stats count by Date, DIRECTION, ATTACH

Date | DIRECTION | ATTACH | count

2014-08-05 | Inbound | HAS_ATTACH | 2491

2014-08-05 | Inbound | NO_ATTACH | 338

2014-08-05 | Outbound | HAS_ATTACH | 568

2014-08-05 | Outbound | NO_ATTACH | 2792

I'd like to have the format as follows - any suggestions?

Date | DIRECTION | HAS_ATTACH | NO_ATTACH

2014-08-05 | Inbound | 2491 | 338

2014-08-05 | Outbound | 568 | 2792

[yuanliu · Accepted solution]

I had a similar use case. I was told that you can't chart over two series in Splunk (as you can in Excel). My solution:

 | eval Date_Direction=Date + ":" + DIRECTION
 | chart sum(count) AS Total over Date_Direction by ATTACH

You get a clean chart, but lose the ability to use Date and Direction for further processing.

If you want to use Date and Direction and don't mind table format, here is a quirky method:

 | eval Date_Direction=Date + ":" + DIRECTION
 | chart sum(count) AS Total over Date_Direction by ATTACH
 | rex field=Date_Direction "(?<Date>[^:]+):(?<DIRECTION>.*)"
 | fields - Date_Direction

This gives you the table you want (somewhat different field orders), but you lose meaningful visualization.

[season88481]

That is a very smart way for doing this.

[RB5]

Okay thanks, I had seen that work around at: http://answers.splunk.com/answers/66471/timechart-with-each-line-defined-by-multiple-fields

If this is true (which I was starting to assume): "you can't chart over two series in Splunk" then I can live with your solution.

Thanks.