Splitting multiple unknown fields to timechart by another field

[cphair]

Hi,

I've been using * in statistical commands for shorthand in writing out the fields. This has been useful on dynamic dashboards where I don't know what source/sourcetype a user will choose, so I don't have to specify field names ahead of time. A format like the following works:

index=internal | timechart avg(*) as avg*

but this one returns no results:

index=internal | timechart avg(*) as avg* by host

I'm guessing the * is eating the host field before the timechart command tries to split by it. Is there anything I can do about this? I'm running 4.3.4.

[rechteklebe]

Try this:

index=internal | timechart avg() as "avg" by host

[cphair]

Doesn't work. Same problem.

[rechteklebe]

the stars are filtered out..so for sure with the stars 😉