How to write a search for a multikv timechart?

[sonicZ]

I have a chart command i've been gathering all the netstat values for a single hour

index=os host=ship*  starttime=10/01/2014:19:00:00 endtime=10/01/2014:19:20:00 sourcetype=netstat | multikv fields State AS netstat_states |  chart count by State, host

Trying to get the equivalent timechart values so I can see when certain states occurred.
here's what i have so far but does not get the actual netstat states, just the count. Looking to get the actual netstat values captured in the timechart as well.

index=os host=ship* sourcetype=netstat | multikv fields State as netstat_states |  timechart span=1h count(netstat_states) by host

[lguinn2 · Accepted solution]

Try this...

index=os host=ship*  starttime=10/01/2014:19:00:00 endtime=10/01/2014:19:20:00 sourcetype=netstat 
| multikv fields State AS netstat_states 
| eval State_host = State . "+" . host 
| timechart count by State_host

[sonicZ]

That was it, will be very useful for timecharting other multikv stats, I had to use a limit=0 but got what i needed with your search. Thanks