I've created a graph of outbound network traffic using metricbeat and timelion as shown in the timelion guide:
.es(index=metricbeat*, timefield=@timestamp, metric=avg:system.network.in.bytes).derivative()
The traffic shown is sum between 8 hosts I have. so if I want to see individuals hosts traffic I'm adding split to the timelion:
.es(index=metricbeat*, timefield=@timestamp, metric=avg:system.network.in.bytes, split=beat.hostname).derivative()
Most of the time I only need in my dashboard the first graph without the split, but in case there is a spike I want to be able to see which host caused it, so I need to switch the graphs \ add the split by press of a button and without editing the visualization. Is there anyway to do that?