Hi,
i´ve got an timechart with different columns (depending on the search). If I get not much columns the high of the timechart is enough. If I get much columns results the timechart high is not enough and all will be pressed together. So I tried to change the high automatically by the column results, but i dont know how to get the correct column results on the "XXXXXXX". $job.resultCount$ is not correct, because it gives me the row results. Someone an Idea?
Linie=$Token_Linie$ Antyp=$Token_Antyp$
| eval combined_field= Linie + " " + Antyp
| eventstats count as "totalCount" by An
| timechart count(totalCount) BY combined_field $Token_IO_NIO_Zeit.earliest$ $Token_IO_NIO_Zeit.latest$
↧