Splunk Search

additional info on timechart

indeed_2000
Motivator

Hi

I need to show id1,id2 on timechart

have table with these columns:

index="myindex" | table duration servername id1 id2

duration     Time                                          servername      id1   id2
2.643000 2021-22-11 18:30:45 Server1               111 32
2.009000 2021-22-11 18:30:45 Server2               321 72

need to create timechart that show durations by servernames and additional column data id1, id2

Any idea?
Thanks

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This is not possible with the standard timechart because you have too many dimensions, time, servername, duration, id1 and id2. You can do it with 3 dimensions e.g. time, servername and one of duration, id1, id2

| xyseries Time servername duration

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

This is not possible with the standard timechart because you have too many dimensions, time, servername, duration, id1 and id2. You can do it with 3 dimensions e.g. time, servername and one of duration, id1, id2

| xyseries Time servername duration
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...