Hi @NK, @gcusello provides a hint about aggregations and split-by fields used in trellis mode. Generally, any output field in the by-clause of an aggregation command like chart, stats, or timechart ...
See more...
Hi @NK, @gcusello provides a hint about aggregations and split-by fields used in trellis mode. Generally, any output field in the by-clause of an aggregation command like chart, stats, or timechart will be available as a split-by field in trellis, and other fields will be treated as aggregations. You can use timechart as a helper to fill in empty hour and status values: index=main sourcetype=access_combined
| timechart fixedrange=true limit=0 span=1h useother=false count by status
| untable _time status count
| rename _time as hour
| stats sum(count) as count by hour status
| fieldformat hour=strftime(hour, "%F %T") When fixedrange=false, timechart will limit its output to the lower and upper _time bounds of the search results. When fixedrange=true, timechart will add empty buckets using the lower and upper _time bounds of your search time range, e.g., earliest=-24h@h latest=@h. When no results are found for an hour of the day, an empty pie chart will be displayed, and missing or zero status values relative to the search results will be aggregated with other status values under the minimum size threshold using the label "other":