Splunk Search

Timechart but based on 2+ more user selections

redrabbit
Observer

Hi everyone,

I have a line chart which works perfectly but only for one single value:

index=events ComputerName=* Account_Name=*** EventCode=$event_code_input$ |
| timechart count by EventCode

As you can see it reads EventCode as a user input. This is a multi-selection box. 

So if the user selects: 

4624 it plots the line - no issue

But if they select 4624 AND 4625, it produces an error. 

 

I've tried many different variations and chart types but no success. 

Thanks

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The timechart command accepts only one field name in the by clause.  Anything else will result in an error.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...