I have three columns in stats.
1. Date
2. Number
3. String Value (ABCDEF)
Once i create a chart over "Date " , how can I also show the corresponding "string value" in the graph?
Since line\Area graph will only consider numerical values, it doesn't show the 3rd field values.
I am expecting to have Date in X axis and Number in Y Axis. Can anyone help?
Perhaps you are looking or xyseries.
I ran a query on the default _audit index so that you can use the code to run as it is. Try the below:
index="_audit" | stats count by _time,action
The above code gives you _time,action and count as columns in the statistics output.
Now, try this :
index="_audit" | stats count by _time,action | xyseries _time,action,count
See the visualization tab, this is perhaps what you want. Replace your fields to map accordingly, basically the below, if the above result is what you want-
Date - _time
Number - count
action - string
Perhaps you are looking or xyseries.
I ran a query on the default _audit index so that you can use the code to run as it is. Try the below:
index="_audit" | stats count by _time,action
The above code gives you _time,action and count as columns in the statistics output.
Now, try this :
index="_audit" | stats count by _time,action | xyseries _time,action,count
See the visualization tab, this is perhaps what you want. Replace your fields to map accordingly, basically the below, if the above result is what you want-
Date - _time
Number - count
action - string
This is exactly what i was looking for. Thank you so much!!