index=nil sourcetype="niller" host=*| eval flag=if(timeout>5000,"Timeout","Total")| timechart span=1m count(flag) as number_of_timeouts by flag
Above search string obtains result from both host (host1,host2). If i want to display unified value from both dashboard host=* is working but i want to display from both host and it has to show both total and timeout also.
Please help how.
Thanks. (splunk 7.0)
I do not think it is possible through timechart command
Well you need to try something like this
index=nil sourcetype="niller" host=*
| bin _time span=1m
| eval flag=if(timeout>5000,"Timeout","Total")
| stats count(flag) as number_of_timeouts by flag host _time
let me know if this helps!
it is not working my scenario, i want to distinguish both the hosts. this search is working but i have to show 2 different host in same chart. please help