timechart 2 different fields in one search

[sbattista09]

I seem to be having issues with time charting, i want to get a trend over time for more then one field. I have tried a few different ways but can get my head around it. I would like to build this off of the example below.

Example "This is in a stacked Column view" -
index=index1 |eval RISK=case(RISK==4,"High",RISK==5,"Severe") |chart count by SUBCATEGORY,RISK useother=f usenull=f

let me know if you need anymore information, i know this is a pretty general question.

thanks!

[sbattista09]

still getting odd results-

|timechart count(eval RISK=4) as "High" count(eval RISK=5) as "Severe" by SUBCATEGORY useother=f usenull=f gave me a chart however it did not count anything, all the results were 0.

|eval RISK=case(RISK==4,"High",RISK==5,"Severe") |timechart count by RISK, SUBCATEGORY useother=f usenull=f gave me "Error in 'timechart' command: The argument 'SUBCATEGORY' is invalid."

Thanks for the help!

[fdi01 · Accepted solution]

use simplily timechart command. is this show you dynamic chart of this two host on times..

index=index1 |eval RISK=case(RISK==4,"High",RISK==5,"Severe") |timechart count by RISK, SUBCATEGORY useother=f usenull=f
or
index=index1 |timechart count(eval RISK=4) as "High" count(eval RISK=5) as "Severe" by SUBCATEGORY useother=f usenull=f

[sbattista09]

thanks,

however i wanted to turn this into a time chart to see a trend over time. Do you think this would be possible ?

[rsennett_splunk]

index=index1 
|chart count(eval RISK=4) as "High" count(eval RISK=5) as "Severe" by SUBCATEGORY useother=f usenull=f