Multiple fields in one chart

[pudanelilita]

Hi,
I struggling to create chart, which will be with multiple field values (max,avg and min pauses) + need to see months (January, February, March etc.) in X-Axis

What I need to change here?
| eval fields=split(_raw," ")
| eval pauses=mvindex(fields,8)
| eventstats max(pauses) as Max_pause
| eventstats avg(pauses) as Avg_pause
| eventstats min(pauses) as Min_pause
| table Max_pause Avg_pause Min_pause

[whrg · Accepted solution]

It would be helpful if you could post some sample data. Does your data have the _time field?

If you want a chart with time as the X-axis, then take a look at timechart.

Try something like this:

... | eval fields=split(_raw," ") | eval pauses=mvindex(fields,8) | timechart span=1mon max(pauses) as Max_pause avg(pauses) as Avg_pause min(pauses) as Min_pause

[pudanelilita]

It worked without span=1mon, thanks!