Hi I am trying below query to plot line chart-
index=abc |eval Time=round(endtime-starttime)|chart values(Time) as Time over _time by Type
Here there can be multiple Type values.
my problem is some _time field has multivalue Time field due to which it is not plotted on graph and I am not able to use mvexpand on Type because Type value is not fixed .
my output looks like below
_time Build
29/01/2019 12:01 2
3
4
29/01/2019 12:12 5
from above only 5 value is getting plotted and others are not seen due to multivalue and here I can not apply `mvexpand Build` as this value can change
↧