I have 3 fields: "Runtime_A", "Runtime_B", and "guid". My current query is:
search | chart values(guid) AS "Guid", values(Runtime_A) AS "Total Runtime", values(Runtime_B) AS "Partial Runtime"
My graph is empty, and there is only one xvalue in the xaxis and its a comma seperated list of all the guids. What's wrong with my query?
Hi @splunkuser2127
Check this link for a clear explanation
https://www.splunk.com/en_us/blog/tips-and-tricks/search-commands-stats-chart-and-timechart.html
... your search and filters with index and sourcetype here ... | chart avg(Runtime_A) as avg_A avg(Runtime_B) as avg_B by guid ...
you can use any functions that you wish ... look into the chart
or stats
command documentation
https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Stats