Splunk Search

Timechart not working after multikv

Hi, I am not sure why timechart does not work for me. I would like a timechart for avg memory used.
I tried the below search:

source=vmstat 
| multikv fields memFreeMB
| timechart span=1h avg(memFreeMB)

the field avg(memFreeMB) is null.

I tried:

source=vmstat 
| multikv fields memFreeMB
| table _time memFreeMB

Which works but it's not a timechart. I tried using an eval command to create a new field =memFreeMB.
But no luck could someone help me with this.
I need a timechart for further analysis

0 Karma

SplunkTrust
SplunkTrust

Your multikv command is limiting the available fields to be just memFreeMB. You need _time field in order to generate timechart. So give this a try

source=vmstat 
| multikv fields _time memFreeMB
| timechart span=1h avg(memFreeMB)
0 Karma