my search is something like
... | stats avg(weight) by color, shape
which results in :
color shape avg(weight)
blue triangle 30
blue circle 20
green triangle 35
I want to do a timechart with each row as a line. I tried replacing stats with timechart but it gave me an error (I'm assuming is because i have it arranged by two fields. How would I go about doing this? I want a line for blue triangle, blue circle and green triangle. Also, is there a convenient way to name the lane via the first+second field name? (e.g. "blue triangle")
Sure, try this
yoursearchhere
| eval color_and_shape = color + " " + shape
| timechart avg(weight) by color_and_shape
Sure, try this
yoursearchhere
| eval color_and_shape = color + " " + shape
| timechart avg(weight) by color_and_shape
Spot on. Thanks.
Thank you so much!! That worked perfectly! 🙂