I have a chart with multiple lines and I want to "merge" them.

[nugetchar]

Hi everyone!
Here is my problem:

Thanks to a search, I have multiple lines on the same graph. But now, I want to merge them in a single line.

My search:

index="dashboards" Step=-1 | bucket _time span=1s | convert timeformat="%H:%M:%S" ctime(_time) AS date_lancement | chart values(Test) as res by date_lancement, AgentID

I create a chart which gives me two lines (because I have two different AgentID in this case), and the values(Test) gives me, for each of them, a number during the time (date_lancement).

So let's say those two lines are f(x) and g(x), I want to draw (f+g)(x).

Any idea? 😃

Thanks in advance,

nugetchar.

[yannK]

why not removing the AgentId field completely and display a timechart ?

index="dashboards" Step=-1 | timechart span=1s sum(Test) as res

[MuS]

Hi nugetchar

I hope I get you right; I think you will get what you want, if you change the formatting option for your chart to chart type area and stack mode to stacked.

hope this helps

cheers,

MuS