Dashboard Line Chart Visualizations with Group By Clauses

[cguerra]

Hello there, new to IDR, but I’ve searched the forums and haven’t found an answer to this.

Is it possible to have a line/area chart visualization using group by clauses in the query?

What I’m trying to see if the usage of the value of a certain key over time, so I have a groupby(key) clause, but it doesn’t allow me to pick the line chart in the chart section of a new card. I haven’t been able to find any answer to this.

If it isn’t possible, is there any other way to do this? For this particular log that I’m working with, the value of the key can be anything. A workaround I found previously was just having where(value = A) clauses and putting two of these queries in one card would let me have a line chart. Doesn’t work when value can be hundreds of different values.

[david_smith]

Hi @cguerra its not possible within a dashboard, but it is possible within log search using the table view on a groupby visualization to see events over time. See example

groupby(“platform”)calculate(count)timeslice(200)

[cguerra]

Thanks for the quick reply. Kind of a bummer that it’s not possible inside a dashboard, since this would probably be one of the more useful combinations. Log search it will have to be then.