how to use multiple fields in timechart command

[mvaradarajam]

Hi All,

How to use

index="*"|timechart count by sourcetype,source

[tom_frotscher]

As an fast solution you might combine the two fields into one field with eval and use the result as by clause:

index=_internal | eval combi=source."#".sourcetype | timechart count by combi

[tom_frotscher]

I don't know what exactly you want to know. There are examples for inpage drilldowns in the splunk 6.1 overview app. https://apps.splunk.com/app/1773/

You should be able to take the combi field as a normal token. If you want to split it up again in source and sourcetype, you can use the rex command:

index=_internal | eval combi=source."#".sourcetype | rex field=combi "(?<first_part>^.*)#(?<second_part>.*$)"