I have been struggling to find the proper syntax for this type of timechart. This relates to creating a Windows PerfMon graph for multiple series (in the same counter) and multiple host to be able to easily compare. For example, I can graph Bytes Received/sec and Bytes Sent/sec with a simple search like:
index=MyIndex object="Network Interface" | timechart span=30min avg(Value) by counter
This provides gives the total for both host. Now I want to essentially add by host to the end of by counter. Any thoughts? Is this a multi-valued field???