I am currently running this search:
index=events host=hig1* or host=hig2* | timechart span-1d dc(host)
the search works and I get the results I need however is there a way to list out all hosts and still get the count?
thanks
1) OR
should be capitalized. 2) span=1d
I don't see how it would work, visually, to show a count and also the names in a single viz panel. Seems like you might want a line chart or bar chart for the dc, and then have a different viz for the names. Like, for instance, build a popup using JS so that when you hover over a particular day, it gets the list of unique names for that day.
Try this
index=events host=hig1* OR host=hig2* | timechart span=1d dc(host) values(host)
let me know if this helps!