Splunk Search

Timechart Split by Multiple Fields for Trellis


Is there a way to split timechart by more than two fields so that I can use a trellis layout for the visualization? (Kind of analogous to a 3D Table?)

Ex: I want to compare the trend of the cost over time for different companies in different countries. The following search has all the data I need. I can then split by country with trellis layout but will not be able to see the comparison between companies.

| stats avg(cost) by _time, Company, Country 

The following works, but I would then need to create individual panels for every country I am interested in.

| search Country = "USA"
| timechart avg(cost) by Company

This gets closer..but the timechart is still not able to split by the "Company" field

| eval temp = _time."-".Company
| xyseries temp,Country, cost
| rex field=temp "(?<_time>([^\s]+))-(?<Company>\w+)"
| fields - temp

Any advice would be much appreciated!

Tags (2)