Hi All,
Would like to know if something like this will work or will there be any other possible solutions.
Chart count over field1 by field2, field3
And i would want to visualise the chart in trellis mode on the basis of field3.
Kindly suggest.
Thanks in advance
@prettysunshinez chart will not allow three field aggregation so you may have to stats
with eval {field2}= aggregation
<yourCurrentSearch>
| stats count by field1 field2 field3
| eval {field2}=count
| fields - field2 count
Then choose trellis by field3
Following is a run anywhere example based on Splunk's _internal index that can be used to split by component
and display count over date_hour by log_level
index=_internal sourcetype=splunkd log_level!=INFO
| stats count by date_hour log_level component
| eval {log_level}=count
| fields - count log_level
@prettysunshinez chart will not allow three field aggregation so you may have to stats
with eval {field2}= aggregation
<yourCurrentSearch>
| stats count by field1 field2 field3
| eval {field2}=count
| fields - field2 count
Then choose trellis by field3
Following is a run anywhere example based on Splunk's _internal index that can be used to split by component
and display count over date_hour by log_level
index=_internal sourcetype=splunkd log_level!=INFO
| stats count by date_hour log_level component
| eval {log_level}=count
| fields - count log_level
Thank you so much..It helped!!