Splunk Search
Highlighted

How to create a line chart so each data point shows three field values?

Path Finder

I generated a line chart and am plotting on two fields: Time and ID, however, I want to see more than just these two fields. Is there a way to generate a chart so that each point on the line chart shows three field values: Time, ID, and Name?

0 Karma
Highlighted

Re: How to create a line chart so each data point shows three field values?

Contributor

Line charts are designed for plotting two values on a axis. If it makes sense, you can concatenate the ID and Name into one field and plot that over time.

<your search> | eval NameID=Name+":"+ID | timechart values(NameID)

View solution in original post

0 Karma
Highlighted

Re: How to create a line chart so each data point shows three field values?

Path Finder

Concatenation makes it look a little long and messy but should work fine. Thanks!

0 Karma