I'm trying to set up a timechart of disk free by host and mountpoint and this is proving difficult, because timechart will only accept one field for a by clause. This doesn't work because the level of uniqueness is host,mount not host or mount. Let me additionally say I loathed the new version of the NIX app on sight and can't stand the new visualisations. The old versions--which I can't download any more for pointers--did the job fine in my opinion. So all I want is for something like this to work:
sourcetype=df| timechart span=1h avg(storage_percent_free) AS pctfree by host, mount
and make a nice, old school line chart which you can extrapolate easily...like the old version did.