The chart
command is useful for turning data across two dimensions. It is useful for both tables and charts. Let's start with one of our examples from stats
:
sourcetype="tm1*" error | chart count over date_month by date_wday
The resulting table looks like this:
If you look back at the results from stats
, the data is presented as one row per combination. Instead of a row per combination, chart
generates the intersection of the two fields. You can specify multiple functions, but you may only specify one field each for over
and by
.
Switching the fields (by rearranging our search statement a bit) turns the data the other way.
By simply clicking on the Visualization tab (to the right of the Statistics tab), we can see these results in a chart:
This is an Area chart, with particular format options set. Within the chart area, you can click on Area to change the chart type (Line, Area, Column, Bar, and so on) or Format to change the format options (Stack, Null Values, Multi-series...