What is an alternative to timechart when needing aggregation on 2 by clauses?

[dmoberg]

I am struggling to figure out how to get the Visualization that I want, if even possible....

Timechart works great for this purpose but only when having 1 By clause (aggregated on one value), so if I have understood it properly, I should use the Stats command which supports multiple aggregations.

The end goal is to have one graph showing the following:

Y-axle: Count of the events

X-axle: Time

Graph lines: One Graph line shows the Count for a unique combination of responseCode and Location

OR possibly using Trellis (probably better) split By Location, so that each Location is a separate graph with one graph line showing the count for the responseCode.

The Search as it is now:

<<SEARCH>> | bin _time as time span=15m | stats count by _time,body.records.properties.responseCode,body.records.location

If using Trellis split by Location, this results in two graphs, one per Location where each has one graph line for Count (no matter the response code) and one more graph line for the response code itself (i.e. response code 200 becomes a line on 200 of the Y-axle). But I want 1 single graph line showing the count per unique responseCode (the legend should display the responseCode (i.e. 200).

Any ideas?

[ITWhisperer · Accepted solution]

Try something like this

SEARCH
| eval status_location = 'body.records.properties.responseCode'."_".'body.records.location'
| timechart span=15m count by status_location

[efavreau]

@dmoberg 

Your description gives you a possible answer. You're looking for a combination of location and statuscode  by time. So that's what you provide to the timechart command:

| eval newfield = 'body.records.properties.responseCode' + "_" + 'body.records.location' ``` double check these single and double quotes due to editor here```
| timechart span=15 count BY newfield

What you end up with is a timechart showing something like this along your timechart:
200_Omaha
404_Anahiem