Splunk Search

additional info on timechart

indeed_2000
Motivator

Hi

I need to show id1,id2 on timechart

have table with these columns:

index="myindex" | table duration servername id1 id2

duration     Time                                          servername      id1   id2
2.643000 2021-22-11 18:30:45 Server1               111 32
2.009000 2021-22-11 18:30:45 Server2               321 72

need to create timechart that show durations by servernames and additional column data id1, id2

Any idea?
Thanks

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This is not possible with the standard timechart because you have too many dimensions, time, servername, duration, id1 and id2. You can do it with 3 dimensions e.g. time, servername and one of duration, id1, id2

| xyseries Time servername duration

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

This is not possible with the standard timechart because you have too many dimensions, time, servername, duration, id1 and id2. You can do it with 3 dimensions e.g. time, servername and one of duration, id1, id2

| xyseries Time servername duration
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...