Timechart group by 2 fields

[ReddySk]

Hello,

I am trying to find a solution to paint a timechart grouped by 2 fields.

I have a stats table like:

Time                  Group    Status     Count
2018-12-18 21:00:00   Group1   Success    15
2018-12-18 21:00:00   Group1   Failure    5
2018-12-18 21:00:00   Group2   Success    1544
2018-12-18 21:00:00   Group2   Failure    44
2018-12-18 22:00:00   Group1   Success    112
2018-12-18 22:00:00   Group1   Failure    4
2018-12-18 22:00:00   Group2   Success    1544
2018-12-18 22:00:00   Group2   Failure    12

I need to get

Time                  Group1 - Success    Group1 - Failure    Group2 - Sucess    Group2 - Failure
2018-12-18 21:00:00                 15                   5               1544                  44
2018-12-18 22:00:00                112                   4               1544                  12

I wanted to use this what I somehow understood from another articles

index="sbox" type=transaction | bin _time | eval groupStatus=Group+" - "+Status |  timechart count as total by groupStatus

but it is giving me...

Time                      NULL
2018-12-18 21:00:00       1608
2018-12-18 22:00:00       1672

Can you please advise the right syntax?

Thank you,
Rudo

[renjith_nair · Accepted solution]

@ReddySk,

Try

"Your current search"
| eval groupstatus=Group." - ".Status
| chart values(Count) as Count over Time  by groupstatus

[ReddySk]

Thank you. It helped.