Splunk Search

Timechart Split by Multiple Fields for Trellis


Is there a way to split timechart by more than two fields so that I can use a trellis layout for the visualization? (Kind of analogous to a 3D Table?)

Ex: I want to compare the trend of the cost over time for different companies in different countries. The following search has all the data I need. I can then split by country with trellis layout but will not be able to see the comparison between companies.

| stats avg(cost) by _time, Company, Country 

The following works, but I would then need to create individual panels for every country I am interested in.

| search Country = "USA"
| timechart avg(cost) by Company

This gets closer..but the timechart is still not able to split by the "Company" field

| eval temp = _time."-".Company
| xyseries temp,Country, cost
| rex field=temp "(?<_time>([^\s]+))-(?<Company>\w+)"
| fields - temp

Any advice would be much appreciated!

Tags (2)
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...