Timechart but based on 2+ more user selections

[redrabbit]

Hi everyone,

I have a line chart which works perfectly but only for one single value:

index=events ComputerName=* Account_Name=*** EventCode=$event_code_input$ |
| timechart count by EventCode

As you can see it reads EventCode as a user input. This is a multi-selection box. 

So if the user selects: 

4624 it plots the line - no issue

But if they select 4624 AND 4625, it produces an error. 

I've tried many different variations and chart types but no success. 

Thanks

[richgalloway]

The timechart command accepts only one field name in the by clause.  Anything else will result in an error.