Hi,
May I know how to use the data from events and draw a line chart in splunk or splunk can not do it?
My input data is simple like this:
type1, field1: 80, field2:100
type2, field1: 90, field2:100
I want to draw a line chart that will show two output : 80/100 as rate1 from type1, 90/100 as rate2 from type2
Thanks!
Try this:
sourcetype=type1 OR sroucetype=type2 | rex "field1\s*:\s*(?<field1>\d+),\s+field2\s*:\s*(?<field2>\d+)" | eval rate=(field1/field2) | timechart rate by sourcetype