Multiline graph
_sourceCategory="source" and _collector="collector"
| parse "[Level:: *]" as MyLevel
| parse "Line:: *]" as MyLine
| parse " Msg:: *" as MyMessage
| parse "JSON ADDED:*," as JSON_ADDED
| parse "JSON REMOVED:*," as JSON_REMOVED
| where MyLevel = "INFO" and MyJob = "myjob" and MyMessage matches "*FINAL REPORT*"
| values(JSON_REMOVED) As TOTAL_JSON_REMOVED | values(JSON_ADDED) As TOTAL_JSON_ADDED
For each message, I have int value in JSON_REMOVED,JSON_ADDED. I would like to plot these 2 values in line chart. Y axis can be time of logging.
Please sign in to leave a comment.
Comments
0 comments