I am trying to create a timechart by 2 fields
Here is what I tried:
source=abc CounterName="\Process(System)\% Processor Time"| timechart span=1h avg(CounterValue) by RoleInstance CounterName
Any idea how this could be achieved?
Something like this
source=abc CounterName="\Process(System)\% Processor Time" | eval Role_Counter=RoleInstance + "#" + CounterName| timechart span=1h avg(CounterValue) by Role_Counter
This is an older one - but for reference:
I don't think, that this is completely true.
chart can have a and a . It's more flexible than
timechart as the can be something other than
_time. But you only have these to split-options (I believe, it was the same in 2014 with version 6.0.# or older).
If I'm wrong, just tell me so I can learn more and more...