I'd like this timechart to be stacked with each vertical stack having in/out for each service_desc. Another way to say it would be that
I want three stacks/columns for each time span. Each column will have 2 values : in_kbps and out_kbps. Any hints?
sourcetype=service_perfdata service_desc="traffic-dc-asa-fw-*"
|rex field=inBandwidth "(?<in_kbps>\d+\.\d+)Kbs"
|rex field=outBandwidth "(?<out_kbps>\d+\.\d+)Kbs"
|eval in_kbps=in_kbps/1024|eval out_kbps=out_kbps/1024
|timechart avg(in_kbps) avg(out_kbps) by service_desc
EDIT: Does not work. It does split them by service_desc but doesnt stack the avgs. Close but no cigar.
Timechart doesnt allow for multi series unfortunately so you have to jump through a few hoops to get this setup. Basing on the docs the below code should do it
sourcetype=service_perfdata service_desc="traffic-dc-asa-fw-*"
|rex field=inBandwidth "(?<in_kbps>\d+\.\d+)Kbs"
|rex field=outBandwidth "(?<out_kbps>\d+\.\d+)Kbs"
|eval in_kbps=in_kbps/1024|eval out_kbps=out_kbps/1024
|stats avg(in_kbps) as AvgIn avg(out_kbps) as AvgOut by _time,service_desc
| eval merge="in_kbps out_kbps"
| makemv merge
| mvexpand merge
| eval YAxis=case(merge=="in_kbps", AvgIn,merge=="out_kbps",AvgOut)
| eval SeriesName=service_desc+":"+merge
| xyseries _time,SeriesName,YAxis