I have a timechart,
But I've liked to display another field value directly on one chart line. (see the picture)
This is the query I'm using:
index="testing_cc_ps" sourcetype="prc_l4_rqmt_progress"
| eval newTime=strptime(date, "%Y-%m-%d")
| eval _time=newTime
| table _time, type, value
| timechart span=1d values(value) by type usenull=false useother=f
The is a third field called Milestone, is it any possibility to write a query that can also plot those milestone on the chart ?
Best regards.
try the appendcols command: https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Appendcols
index="testing_cc_ps" sourcetype="prc_l4_rqmt_progress"
| eval newTime=strptime(date, "%Y-%m-%d")
| eval _time=newTime
| table _time, type, value
| timechart span=1d values(value) by type usenull=false useother=f
| appendcols [search (base search stuff) | timechart for milestones]
try the appendcols command: https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Appendcols
index="testing_cc_ps" sourcetype="prc_l4_rqmt_progress"
| eval newTime=strptime(date, "%Y-%m-%d")
| eval _time=newTime
| table _time, type, value
| timechart span=1d values(value) by type usenull=false useother=f
| appendcols [search (base search stuff) | timechart for milestones]