Multiple Timecharts by a field in single search

[nagpalga]

I wanted to create multiple timecharts in a single search. The scenario i am stuck in is something like this :

index = "A" sourcetype = "B" | where Activity_type = "Activity1" | timechart span=10m count by Event_Type

There are multiple activity_type fields and i want multiple timecharts by Event_Type for different Activity_type in a single search.

Thanks in advance for your help.

[j0e3gan]

I would like to do the same in a dashboard if possible -- generate a timechart per host in the search results.  Might someone be able to provide some insight here, even point to similar question that has been answered?  Thanks.

[tscroggins]

I've used the trellis option to achieve this. For example:

index=_internal sourcetype=splunkd source=*/splunkd.log*
| bin _time span=10m
| stats count(eval(case(log_level=="ERROR", log_level))) as ERROR count(eval(case(log_level=="WARN", log_level))) as WARN count(eval(case(log_level=="INFO", log_level))) as INFO by _time component

will produce a table of log_level counts by _time and component:

_time	component	ERROR	WARN	INFO
2021-02-20 11:00	AdminManager	0	1	0
...	...	...	...	...

In the chart configuration, enable trellis and split by the desired field. I split by component in this example to display counts of events by log_level over time per component.

[j0e3gan]

Trellis options give me a timechart per server using my browser, which is perfect.  Only downside for me is that PDF export does not support trellis options, but this is still a handy approach when PDF export is not a concern.  Thanks!

[ITWhisperer]

In your dashboard, near the top of the simpleXML, you can have a base search

  <search id="base_search">
    <query>index = "A" sourcetype = "B" | timechart span=10m count by Activity_type, Event_Type</query>

Then in each dashboard panel, you set the query to be based on your base search with the additional where clause

      <chart>
        <search base="base_search">
          <query>| search "Activity1"</query>
        </search> 

[j0e3gan]

In the dashboard where I tested your suggestion, a base search in the related panel followed by a post-process search in each of the panel's charts works well -- gives me a timechart per server both in my browser and PDF exports.  Only downside is having to know the number of servers to prepare a chart with a post-process search per server, which is not quite as clean as the trellis option mentioned that dynamically produces charts for n servers.  Still, compatibility with PDF exports requires tradeoffs with maintainability in my experience, so this solution is great when I need it.  Thanks!