Hi @RSS_STT Use a stats command like this: | chart values(utilization) over Host by drive_Name | makeresults count=3
| streamstats count
| eval Host=case(count=1 OR count=3, "aaa", count...
See more...
Hi @RSS_STT Use a stats command like this: | chart values(utilization) over Host by drive_Name | makeresults count=3
| streamstats count
| eval Host=case(count=1 OR count=3, "aaa", count=2, "bbb"),
drive_Name=case(count=1 OR count=2, "D:", count=3, "E:"),
utilization=case(count=1, 20, count=2, 30, count=3, 60)
| fields - count _time
| chart values(utilization) over Host by drive_Name Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing