Splunk Search

Graph by field value not by field count

fizwit
Explorer

Why can't I make a graph by field value directly?

This works:
index=logs Error_Type="WARN" | timechart count(Error_Type)

This does not
index=logs | timechart count(Error_Type="WARN")

I would like to to this graph two types of error on the same pannel
index=logs | timechart count(Error_Type="WARN"), count(Error_Type="ERROR")

fizwit
Explorer

Thanks, that worked perfectly!

0 Karma

chris
Motivator

Hi fizwit,

this is possible have a look at the documentation of the timechart command (Example 5) you were pretty close there is just an eval missing:

 index=logs | timechart count(eval(Error_Type="WARN")) AS WARN, count(eval(Error_Type="ERROR")) AS ERROR

Good luck

Chris

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...