Timelion visualizer dynamic split based on cardinality

[yoavsradware]

hi ,
I have number of devices which I healthcheck every x minutes
I would like to use timelion and to show data based on the device and in the same chart show date of two devices
this one works prefectly for one device :

.es(index=ssl*, metric='max:spcpumax').label('spcpu Max')

but I would like now to to do it based on the fieeld device_id as unique device :

for 2 devices two lines (each represent another device )
for 3 devices
for N devices the same with me hardcoded doing that
from what i read I can use split and cardinality but I failing to do so , can anyone advise ?

[tylersmalley]

I believe split is what you're looking for.

.es(index=ssl*, metric='max:spcpumax', split='device_id:100')

[yoavsradware]

your solution is 99% correct
I am using kibana 5.6.3 and from what i read and used Ineed to use

.keyword

like this :

.es(index=ssl, metric='max:spcpumax', split='device_id.keyword:100')

and it solves my issue , thanks a lot .