Splunk Search

Timechart, 2nd field value on the chart

dfofie
New Member

I have a timechart,

But I've liked to display another field value directly on one chart line. (see the picture)
alt text

This is the query I'm using:

index="testing_cc_ps" sourcetype="prc_l4_rqmt_progress"
| eval newTime=strptime(date, "%Y-%m-%d")
| eval _time=newTime
| table _time, type, value
| timechart span=1d values(value) by type usenull=false useother=f

The is a third field called Milestone, is it any possibility to write a query that can also plot those milestone on the chart ?
Best regards.

0 Karma
1 Solution

kmaron
Motivator

try the appendcols command: https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Appendcols

index="testing_cc_ps" sourcetype="prc_l4_rqmt_progress" 
| eval newTime=strptime(date, "%Y-%m-%d") 
| eval _time=newTime 
| table _time, type, value 
| timechart span=1d values(value) by type usenull=false useother=f
| appendcols [search (base search stuff) | timechart for milestones]

View solution in original post

0 Karma

kmaron
Motivator

try the appendcols command: https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Appendcols

index="testing_cc_ps" sourcetype="prc_l4_rqmt_progress" 
| eval newTime=strptime(date, "%Y-%m-%d") 
| eval _time=newTime 
| table _time, type, value 
| timechart span=1d values(value) by type usenull=false useother=f
| appendcols [search (base search stuff) | timechart for milestones]

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!