Hi I have a field, mode, which returns either returns data or is None (mode_true, mode_false). I'm trying to search and aggregate the sum [over time] of both outcomes over separately then plot both on a timechart (as a stacked bar or similar, where the data is separated categorically). I've tried a couple query types below with no luck 1.)
index=mode_qa module=mode_producer_logs "telemetry_event"
| extract pairdelim="\"{,}" kvdelim=":"
| multisearch [search mode!=None | eval type="mode_true"] [search mode=None | eval type="mode_false"]
| timechart span=60m count(mode) by type
2.)
index=mode_qa module=mode_producer_logs "telemetry event"
| extract pairdelim="\"{,}" kvdelim=":"
| eval modeBool = if(mode!=None, "mode_true", "mode_false")
| timechart count by modeBool span=30m
Both display a visual with only one data source (not binary, e.g. mode_true vs mode_false). Any ideas? New to Splunk
... View more