Splunk Search

How to create double aggregation on timechart?

mxh7777
Path Finder

Hi,

I got a table data with 3 fields (Time, Method, Return)

Time Method Return
28/10/2022 Method 1 KO
28/10/2022 Method 2 KO
28/10/2022 Method 1 OK
28/10/2022 Method 1 OK
28/10/2022 Method 1 OK
28/10/2022 Method 1 OK
... ... ...
29/10/2022 Method 2 OK
29/10/2022 Method 2 OK
29/10/2022 Method 2 OK
29/10/2022 Method 2 OK
29/10/2022 Method 2 OK
29/10/2022 Method 2 OK
29/10/2022 Method 2 OK

 

I'd like to make a timechart with double agregation (one per Method, then one per Return) to get this kind of chart

mxh7777_0-1667566270394.png

The only thing I can do for the moment is this chart with this request

 

 

| timechart count(eval(Return="KO")) as KO count(eval(Return="OK")) as OK by Method

 

 

mxh7777_1-1667566328983.png

Do you know how I can get the first timechart ?

 

Thanks

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...