Splunk Search

how to use multiple fields in timechart command

mvaradarajam
Path Finder

Hi All,

How to use

index="*"|timechart count by sourcetype,source

Tags (1)
0 Karma

tom_frotscher
Builder

As an fast solution you might combine the two fields into one field with eval and use the result as by clause:

index=_internal | eval combi=source."#".sourcetype | timechart count by combi

tom_frotscher
Builder

I don't know what exactly you want to know. There are examples for inpage drilldowns in the splunk 6.1 overview app. https://apps.splunk.com/app/1773/

You should be able to take the combi field as a normal token. If you want to split it up again in source and sourcetype, you can use the rex command:

index=_internal | eval combi=source."#".sourcetype | rex field=combi "(?<first_part>^.*)#(?<second_part>.*$)"
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...