Splunk Search

Is there a way to group by multiple fields in a timechart?

daniel333
Builder

All,

I am looking to create a single timechart which displays the count of status by requestcommand by action. So two "by's". Maybe I should compound the field?

tag=myrest "https://api.mydomain.net/somemethod/listings/*" host=MYHOST*
| rex field=_raw "action=(?<requestcommand>RELEASE|HOLD|EXTEND|PURCHASE)"
| rename event.Properties.LogEntry.ResponseStatusCode AS status
| search status=*
| timechart count(status) by action, requestcommand
0 Karma

mayurr98
Super Champion

Try this :

tag=myrest "https://api.mydomain.net/somemethod/listings/*" host=MYHOST* 
| bin _time span=5m \\specify time span 
| rex field=_raw "action=(?<requestcommand>RELEASE|HOLD|EXTEND|PURCHASE)" 
| rename event.Properties.LogEntry.ResponseStatusCode AS status 
| search status=* 
| stats count(status) as status_count by _time action requestcommand

Let me know if this helps!

0 Karma

somesoni2
Revered Legend

Yes.. combine the field before your timechart command.

...| eval action_rcommand=action.":".requestcommand
| timechart count(status) by action_rcommand
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...