I have a search with a timechart grouped by a fieldname that would like to displayed on a multilines chart on the same graph, How i can do that?
host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory"
| where MESSAGE like "%Low Power%"
| rex field=MESSAGE "Power :(?<Voltage>.{5})"
| timechart span=1d eval(min(LowVolt)) as LowVoltage by DEVICE
I am not sure why you need the eval
. Does the following work?
host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory"
| where MESSAGE like "%Low Power%"
| rex field=MESSAGE "Power :(?<Voltage>.{5})"
| timechart span=1d min(LowVolt) as LowVoltage by DEVICE
I am not sure why you need the eval
. Does the following work?
host="fieldcontroller.wavemark.net" sourcetype="zenosseventhistory"
| where MESSAGE like "%Low Power%"
| rex field=MESSAGE "Power :(?<Voltage>.{5})"
| timechart span=1d min(LowVolt) as LowVoltage by DEVICE