I have a chart command i've been gathering all the netstat values for a single hour
index=os host=ship* starttime=10/01/2014:19:00:00 endtime=10/01/2014:19:20:00 sourcetype=netstat | multikv fields State AS netstat_states | chart count by State, host
Trying to get the equivalent timechart values so I can see when certain states occurred.
here's what i have so far but does not get the actual netstat states, just the count. Looking to get the actual netstat values captured in the timechart as well.
index=os host=ship* sourcetype=netstat | multikv fields State as netstat_states | timechart span=1h count(netstat_states) by host