The [Splunk 7.3 release notes][1] describe the following "what's new" item:
> **Chart multiple series**
> Co-analyze multiple related metrics easily in the same view and create sophisticated visualizations for monitoring.
According to the Splunk 7.3.1 documentation topic "[Build a chart of multiple data series][2]":
> Splunk transforming commands do not support a direct way to define multiple data series in your charts (or timecharts). However, you CAN achieve this using a combination of the stats and xyseries commands."
I've read that topic before, in previous Splunk versions, and have used the techniques it describes.
So, I'm curious: **what is *actually new* about this item for 7.3?** Does it refer to some new feature in SPL?
Or—noting the reference to, or qualification, *metrics* in that 7.3 "what's new" item—perhaps what's new here is a new feature in the Metrics Workspace, which generates SPL that uses the techniques in that "Build a chart of multiple data series"?
Confession: I dip in and out of Splunk every so often. I've read about metrics and the Metrics Workspace, but not yet used them. So far, I've only used *events* with SPL and Simple XML to develop dashboards.
[1]: https://docs.splunk.com/Documentation/Splunk/7.3.0/ReleaseNotes
[2]: https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Chartmultipledataseries
↧