Hi,
I struggling to create chart, which will be with multiple field values (max,avg and min pauses) + need to see months (January, February, March etc.) in X-Axis
What I need to change here?
| eval fields=split(_raw," ")
| eval pauses=mvindex(fields,8)
| eventstats max(pauses) as Max_pause
| eventstats avg(pauses) as Avg_pause
| eventstats min(pauses) as Min_pause
| table Max_pause Avg_pause Min_pause
It would be helpful if you could post some sample data. Does your data have the _time field?
If you want a chart with time as the X-axis, then take a look at timechart.
Try something like this:
... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause
It would be helpful if you could post some sample data. Does your data have the _time field?
If you want a chart with time as the X-axis, then take a look at timechart.
Try something like this:
... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause
It worked without span=1mon, thanks!