Hi I am trying below query to plot line chart-
index=abc |eval Time=round(endtime-starttime)|chart values(Time) as Time over _time by Type
Here there can be multiple Type values.
my problem is some _time field has multivalue Time field due to which it is not plotted on graph and I am not able to use mvexpand on Type because Type value is not fixed .
my output looks like below
_time Build
29/01/2019 12:01 2
3
4
29/01/2019 12:12 5
from above only 5 value is getting plotted and others are not seen due to multivalue and here I can not apply mvexpand Build
as this value can change
Try the stats command instead
index=abc |eval Time=round(endtime-starttime)|stats values(Time) as Time by _time Type
Thanks for comment @jkat54
but if I try this |stats values(Time) as Time by _time Type|mvexpand Time
i will get below result
_time Type Time
29/01/2019 12:01 Build 2
29/01/2019 12:01 Build 3
29/01/2019 12:01 Build 4
29/01/2019 12:12 Build 5
and If i plot line chart it will have legend as Time and Type instaead of value of Type i.e. Build
I want result as-
_time Build
29/01/2019 12:01 2
29/01/2019 12:01 3
29/01/2019 12:01 4
29/01/2019 12:12 5
add a |rename Time as Build | fields -Type
and you will get your desired result
here for example I shown Build but there can be Build and Deploy under Type
hi @ips_mandar
i didn't understand what do u want ,i can't see above example Type
Can u explain what u had and what do u want simply
So Type
is fieldname and it's value can be Build
or Deploy
or both
.
After Running this query-
index=abc |eval Time=round(endtime-starttime)|chart values(Time) as Time over _time by Type
I got below results-
_time Build
29/01/2019 12:01 2
3
4
29/01/2019 12:12 5
But I want to have seggregated result like
_time Build
29/01/2019 12:01 2
29/01/2019 12:01 3
29/01/2019 12:01 4
29/01/2019 12:12 5
This can be achieved using mvexpand Build
but Build value is not fixed. so is there any other way..
Have you tried using |filldown _time
??
thnks @DMohn but it won't help