Splunk Search

additional info on timechart

indeed_2000
Motivator

Hi

I need to show id1,id2 on timechart

have table with these columns:

index="myindex" | table duration servername id1 id2

duration     Time                                          servername      id1   id2
2.643000 2021-22-11 18:30:45 Server1               111 32
2.009000 2021-22-11 18:30:45 Server2               321 72

need to create timechart that show durations by servernames and additional column data id1, id2

Any idea?
Thanks

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This is not possible with the standard timechart because you have too many dimensions, time, servername, duration, id1 and id2. You can do it with 3 dimensions e.g. time, servername and one of duration, id1, id2

| xyseries Time servername duration

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

This is not possible with the standard timechart because you have too many dimensions, time, servername, duration, id1 and id2. You can do it with 3 dimensions e.g. time, servername and one of duration, id1, id2

| xyseries Time servername duration
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...