'splunk chart doesn't show all site data

from checkbox value, if i choose multiple sites, i would like to show all sites separate line chart for avgtrackout time. now the problem if i choose multiple sites, it only show one line chart by coming all sites avgtrackout value.

query: MicronSite IN($site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?<AvgTotalTrackoutTime>\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h avg(command_time)

For example: from check box list i choose "F10N" and "F10W". but in chart, only show one line by combing those two site avgtotaltrackout time values and show one chart. i would like to show separate avgtotal trackout time value for two separate chart

please help to suggest for this issue



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source