Splunk Search

additional info on timechart

indeed_2000
Motivator

Hi

I need to show id1,id2 on timechart

have table with these columns:

index="myindex" | table duration servername id1 id2

duration     Time                                          servername      id1   id2
2.643000 2021-22-11 18:30:45 Server1               111 32
2.009000 2021-22-11 18:30:45 Server2               321 72

need to create timechart that show durations by servernames and additional column data id1, id2

Any idea?
Thanks

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This is not possible with the standard timechart because you have too many dimensions, time, servername, duration, id1 and id2. You can do it with 3 dimensions e.g. time, servername and one of duration, id1, id2

| xyseries Time servername duration

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

This is not possible with the standard timechart because you have too many dimensions, time, servername, duration, id1 and id2. You can do it with 3 dimensions e.g. time, servername and one of duration, id1, id2

| xyseries Time servername duration
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...