Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to use Timechart count by a subsearch field

$
0
0
Hello, I'm trying to use "timechart count by" a field from a subsearch. Bellow, my query that is not working. index=index_cbo "Scope State: 65280" | eval CNPJPDV= CNPJ."-".PDV | append [search index=index_cbo_pt | eval CNPJPDV= CNPJ."-".PDV_PT| search index=index_cbo_pt [search index=index_cbo "Scope State: 65280" | eval CNPJPDV= CNPJ."-".PDV | table CNPJPDV] | table CNPJPDV PaymentChannelName]| timechart span=5m count by PaymentChannelName It's resulting in a timechart will NULL column. Thanks in advance. Cheers, rs

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>