Splitting a field value based on other field

[subash (subash prabhakar)]

I have an index having the below fields

1. Time (every 5 minutes)
2. MetricType Name (having values Inbound traffic , Outbound traffic)
3. Metric Value (values for Inbound and Outbound traffic)

I want to plot a Line graph having Time in the X axis and 2 lines plotting Inbound and Outbound metric values.

Please help me to achieve this.

Regards
Subash

[markov00 (Marco Vettorello)]

Hi, you can use Lens for that: just drag the time field on the central area chart, drag the Metric Value field into the Y axis field on the right (adjust the aggregation to your needs, like sum, count etc) and then drag the MetricTypeName field to the breakdown by using the top value function.
This should lead to the result you are looking for.

If you want to the legacy Line chart, available on the Visualize chart type panel, you can do that in a similar way: select your MetricValue and it's aggregation on the Metrics panel, then a Date Histogram on the Buckets panel and finally click on split series and specify a terms aggregation over MetricType Name to split to have two different set of metrics depending on the MetricType Name

[subash (subash prabhakar)]

Thanks a lot @markov00. It works