If I understand your problem correctly - you have two fields (sensor1 and sensor2) which contain your data points but you have also a "classifying" field host effectively giving you four separate dat...
See more...
If I understand your problem correctly - you have two fields (sensor1 and sensor2) which contain your data points but you have also a "classifying" field host effectively giving you four separate data series, right? And you want to get four separate fields from that to be able to do four dinstinct aggregations for your timechart. Well, there might be several different possible approaches to this. One is to just use a set of conditional evals to create synthetic fields from your data as @yuanliu showed. The downside to this method is that it can be tedious to write all those evals and keep track of them, especially if your data is more complicated than just two sensors and two hosts. Another one is to use the {} notation to dynamically create field names. A run-anywhere example (not really timecharting much due to just a few input values but showing the idea) | makeresults format=csv data="_time,sensor1,sensor2,host 1,1,2,host1 1,2,3,host2 2,4,5,host1 2,5,6,host2" | eval {host}sensor1=sensor1 | eval {host}sensor2=sensor2 | fields - sensor1 sensor2 | timechart avg(host*sensor*) as ** This is easier to maintain because it's happening automagically but the downside is that you have much less control over resulting field names (of course you can rename them manually but that's when we again step into the field of manual fiddling with your data).