When using the timechart command, how do you show multiple Max Values?

[luckyman80]

Hi Splunk Community! Quick one for all you experts!

I'm trying to timechart the following 4 separate metrics (representing a threading model and latency in nanoseconds). I don't get any results back when performing the below, but when i search for just for Max1 and search Thread:1(obviously just using timechart for Max1, it plots fine

FullRunLatency sourcetype="my-logs"  source="/var/tmp/mylogs.log*" 
| rex field=source "prototype(?.*?)_"| search Thread:1 
|rex "Latency.* Max: (?.*?)ns"   
| rex field=source "prototype(?.*?)_"| search Thread:2 
|rex "Latency.* Max: (?.*?)ns"   
| rex field=source "prototype(?.*?)_"| search Thread:3 
|rex "Latency.* Max: (?.*?)ns"   
| rex field=source "prototype(?.*?)_"| search Thread:4
|rex "Latency.* Max: (?.*?)ns"   
| timechart  max(Max1), max(Max2), max(Max3), max(Max4) by instance span=1m

Any ideas? Thanks in advance

[sduff_splunk · Accepted solution]

The issue you are having is because you have a | search Thread:1, all other threads are being discarded after that point.

You probably need to incorporate the Thread:1 etc... into your rex statement. Can you provide some log samples.