topic Re: Splunk SPL & visualisation in Splunk Enterprise

Splunk SPL & visualisation

uagraw01 — Wed, 06 Dec 2023 14:58:30 GMT

Hello Splunkers!!

index=messagebus "AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName"="ASR/Hb/*/Entry*" OR "AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName"="ASR/Hb/*/Exit*" | stats count by "AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName" |fields - _raw | fields AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName | rex field=AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName "(?<location>Aisle\d+)" | fields - AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName |strcat "raw" "," location group_name | stats count BY location group_name

Current visualisation I am getting by above search in column chart:

I want to obtain below visualization. Please guide me what changes I need to used in my current SPL to obtain below visualization.

Re: Splunk SPL & visualisation

ITWhisperer — Wed, 06 Dec 2023 14:19:54 GMT

Try changing

| stats count BY location group_name

| chart count BY location group_name

then use a stacked column chart

Re: Splunk SPL & visualisation

uagraw01 — Wed, 06 Dec 2023 16:07:46 GMT

@ITWhisperer

Below is the visualization I am getting after changing from stats to chart.

Re: Splunk SPL & visualisation

ITWhisperer — Wed, 06 Dec 2023 16:20:39 GMT

| timechart span=1d count by location

Re: Splunk SPL & visualisation

uagraw01 — Wed, 06 Dec 2023 16:35:10 GMT

@ITWhisperer

No results, I think strcat is working together with location and group_name

Re: Splunk SPL & visualisation

ITWhisperer — Wed, 06 Dec 2023 16:58:57 GMT

The visualisation you said you wanted doesn't have raw.location in. Please clarify what you want in your visualisation, what fields you have and how you want to use them

Re: Splunk SPL & visualisation

uagraw01 — Wed, 06 Dec 2023 17:05:51 GMT

@ITWhisperer group_name is the raw.location and in the visualisation they are using. I want the same Visualisation as mentioned earlier.

Re: Splunk SPL & visualisation

ITWhisperer — Wed, 06 Dec 2023 17:09:32 GMT

| timechart span=1d count by group_name

Re: Splunk SPL & visualisation

uagraw01 — Wed, 06 Dec 2023 17:25:53 GMT

@ITWhisperer Thats also not workng.

See the below events from the search and want the expected visualization.

Re: Splunk SPL & visualisation

ITWhisperer — Wed, 06 Dec 2023 17:30:43 GMT

I think you may have been told this before but if you want a time element in your visualisation, it needs to be in your results table. Your search is removing the _time field (or not including it). You need to rework your search accordingly.

Re: Splunk SPL & visualisation

uagraw01 — Wed, 06 Dec 2023 17:35:56 GMT

@ITWhisperer

I have included _time in my search, and the results are still the same.

Re: Splunk SPL & visualisation

ITWhisperer — Wed, 06 Dec 2023 17:38:03 GMT

Try this

| timechart span=1d count by location