help to values many fields in timechart command

[jip31]

hi

i use the search below for displaying a timechart
as you can see, the timechart is sorted by host

`toto` 
    earliest=-5d latest=now 
| lookup test.csv HOSTNAME as host output SITE MODEL 
| timechart avg(BootTime) as "Boot time" by host limit=10 useother=false

but I also need to values the fields SITE and MODEL in order to have for an host, the avg(BootTime), the SITE and the MODEL
Something like :

    | timechart avg(BootTime) as "Boot time" by host SITE MODEL

How to do for values other fields with a timechart command please???

[to4kawa · Accepted solution]

....
|eval tmp=host.":".SITE.":".MODEL
| timechart avg(BootTime) as "Boot time" by tmp
| rex field=tmp "(?<host>\S+?):(?<SITE>\S+?):(?<MODEL>\S+)"
| fields - tmp

[jip31]

It doesnt works
if I am doing | search SITE=* OR MODEL=* I have no results
And i also need to display the timechart by host
Actually instead host I have "NULL"

[to4kawa]

@jip31

Of course you do the query after the lookup, right?

it doesn't works
You say this and you know the cause and what to do?

[jip31]

yes after the lookup
and i dont know why | search SITE=* OR MODEL=* doesnt works

[to4kawa]

| search SITE=* OR MODEL=* is unnecessary.