Splunk Search

Timechart Comparing Two Values

vtsguerrero
Contributor

Can Anyone Please Help Me With This Synthax?
I've got an extracted from xml field already (CodigoCanal) And One Database field (COD_TIPO_SITU_PSST) and I really need to make a timechart for these two as follows

  • index=main sourcetype=main_perfomance| timechart max(CodigoCanal,COD_TIPO_SITU_PSST) *

How can I make this work asap pliz...
Thanks in advance!

0 Karma

lguinn2
Legend

Try this

index=main sourcetype=main_perfomance
| timechart max(CodigoCanal) max(COD_TIPO_SITU_PSST)

Although you may need to give a clearer description of what you want to to see on the timechart. I am just guessing.

somesoni2
Revered Legend

Could you provide more details upon what you want to plot? plot whichever is maximum of CodigoCanal COD_TIPO_SITU_PSST?

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...