Splunk Search

how to use multiple fields in timechart command

mvaradarajam
Path Finder

Hi All,

How to use

index="*"|timechart count by sourcetype,source

Tags (1)
0 Karma

tom_frotscher
Builder

As an fast solution you might combine the two fields into one field with eval and use the result as by clause:

index=_internal | eval combi=source."#".sourcetype | timechart count by combi

tom_frotscher
Builder

I don't know what exactly you want to know. There are examples for inpage drilldowns in the splunk 6.1 overview app. https://apps.splunk.com/app/1773/

You should be able to take the combi field as a normal token. If you want to split it up again in source and sourcetype, you can use the rex command:

index=_internal | eval combi=source."#".sourcetype | rex field=combi "(?<first_part>^.*)#(?<second_part>.*$)"
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...