Splunk Search
Highlighted

Timechart, 2nd field value on the chart

New Member

I have a timechart,

But I've liked to display another field value directly on one chart line. (see the picture)
alt text

This is the query I'm using:

index="testing_cc_ps" sourcetype="prc_l4_rqmt_progress"
| eval newTime=strptime(date, "%Y-%m-%d")
| eval _time=newTime
| table _time, type, value
| timechart span=1d values(value) by type usenull=false useother=f

The is a third field called Milestone, is it any possibility to write a query that can also plot those milestone on the chart ?
Best regards.

0 Karma
Highlighted

Re: Timechart, 2nd field value on the chart

Motivator

try the appendcols command: https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Appendcols

index="testing_cc_ps" sourcetype="prc_l4_rqmt_progress" 
| eval newTime=strptime(date, "%Y-%m-%d") 
| eval _time=newTime 
| table _time, type, value 
| timechart span=1d values(value) by type usenull=false useother=f
| appendcols [search (base search stuff) | timechart for milestones]

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.