Is there a way to split timechart by more than two fields so that I can use a trellis layout for the visualization? (Kind of analogous to a 3D Table?)
Ex: I want to compare the trend of the cost over time for different companies in different countries. The following search has all the data I need. I can then split by country with trellis layout but will not be able to see the comparison between companies.
| stats avg(cost) by _time, Company, Country
The following works, but I would then need to create individual panels for every country I am interested in.
| search Country = "USA"
| timechart avg(cost) by Company
This gets closer..but the timechart is still not able to split by the "Company" field
| eval temp = _time."-".Company
| xyseries temp,Country, cost
| rex field=temp "(?<_time>([^\s]+))-(?<Company>\w+)"
| fields - temp
Any advice would be much appreciated!
