Further to my previous post here, which was generously solved by ITWhisperer:
Solved: Help with search to use for dashboard - link key-v... - Splunk Community
My chart looks like this (which is what I wanted to achieve).
My challenge now is to have charts which:
Again, any help much appreciated.
NM
Current Search:
| where key="counter_01" AND mac_address="xx:yy:zz:aa:bb:01" | timechart values(value) by key
Sample search which allows me to view via a variable (hostname). Note - this is an unrelated project - I'm just using for illustration:
host=$host_name$ source="xxx"| timechart avg(value 1) as "Avg Value 1" avg(value_2) as "Avg Value 2" by host
One issue I see is that I already have a "by" defined in this project, which is "by key".
You can chart multiple mac_addresses for the same counter like this:
| where key="counter_01"
| timechart values(value) by mac_address
You could also populate a multi-select dropdown with values from an index search
index=your index
| dedup mac_address
| fields mac_address
For this, you would set <fieldForValue> and <fieldForLabel> to mac_address
<fieldForValue>mac_address</fieldForValue>
<fieldForLabel>mac_address</fieldForLabel>
You don't have to use the same field for both if your search returns something more user friendly
You can chart multiple mac_addresses for the same counter like this:
| where key="counter_01"
| timechart values(value) by mac_address
You could also populate a multi-select dropdown with values from an index search
index=your index
| dedup mac_address
| fields mac_address
For this, you would set <fieldForValue> and <fieldForLabel> to mac_address
<fieldForValue>mac_address</fieldForValue>
<fieldForLabel>mac_address</fieldForLabel>
You don't have to use the same field for both if your search returns something more user friendly