Timechart question

[bgill0123]

I am currently running this search:

index=events host=hig1* or host=hig2* | timechart span-1d dc(host)

the search works and I get the results I need however is there a way to list out all hosts and still get the count?

thanks

[DalJeanis]

1) OR should be capitalized. 2) span=1d

I don't see how it would work, visually, to show a count and also the names in a single viz panel. Seems like you might want a line chart or bar chart for the dc, and then have a different viz for the names. Like, for instance, build a popup using JS so that when you hover over a particular day, it gets the list of unique names for that day.

[mayurr98]

Try this

index=events host=hig1* OR host=hig2* | timechart span=1d dc(host) values(host)

let me know if this helps!