Using stats with a by on 2 fields works:
...| stats max(kpi1) as "kpi1" max(kpi2) as "kpi2" by field1 field2
but can I do the same using timechart? (so far I don't think I can)
...| timechart max(kpi1) as "kpi1" max(kpi2) as "kpi2" by field1 field2
A work around I have is to use strcat
which would be something like:
...| strcat field1 "-" field2 field1_2 | timechart max(kpi1) as "kpi1" max(kpi2) as "kpi2" by field1_2
Just wondering what other people do?
You can't visualize this directly, but I use the following when I want time series data on multiple dimensions:
...| bucket _time | stats count by _time field_1 field_2
tks, as you say not great for visualisation but looks good it the stats tab.
How do I control the _time granularity using this way?
You can optionally add a span=
to bucket
just like timechart
.
... | bucket _time span=1d | ...