timechart where field name and value are both in event data

[kmaron]

I have a database query that runs every 5 minutes. It brings back queue names and the counts of those queues. I would like to make a timechart that would show all of the queues and their counts over time.

My data comes out like this:

2017-02-09 10:51:30 QUEUE="LIFEUpdatePolicySecurity", LIFEQUEUECOUNT="5"
2017-02-09 10:51:30 QUEUE="LIFEUpdateAnnuitySecurity", LIFEQUEUECOUNT="38"
2017-02-09 10:51:30 QUEUE="Policy File Document", LIFEQUEUECOUNT="3"
2017-02-09 10:51:30 QUEUE="Annuity File Document", LIFEQUEUECOUNT="25"

I would like to eventually end up with a line graph that would have a line or each queue name and show the count for each over time but I'm struggling to get the stats to line up to get it there.

[richgalloway · Accepted solution]

Have you tried ... | timechart max(LIFE_QUEUE_COUNT) by QUEUE ?

[somesoni2]

If you've 10 or more distinct QUEUEs, then add limit=0 ( or any feasible number) so that there is a line for every queue.

[kmaron]

See I knew it was going to be something simple. I just had to flip my thinking. Thank you so much that's exactly what I wanted!!