Splunk Search

how to use multiple fields in timechart command

Path Finder

Hi All,

How to use

index="*"|timechart count by sourcetype,source

Tags (1)
0 Karma


As an fast solution you might combine the two fields into one field with eval and use the result as by clause:

index=_internal | eval combi=source."#".sourcetype | timechart count by combi


I don't know what exactly you want to know. There are examples for inpage drilldowns in the splunk 6.1 overview app. https://apps.splunk.com/app/1773/

You should be able to take the combi field as a normal token. If you want to split it up again in source and sourcetype, you can use the rex command:

index=_internal | eval combi=source."#".sourcetype | rex field=combi "(?<first_part>^.*)#(?<second_part>.*$)"
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!