topic Re: turn a columns with multiple entries into a chart in Getting Data In https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563209#M100352 <P>Great solution, just noticed that my solution has the issues that I'm dedupping the same results so this will lead to an incorrect total value</P> Fri, 13 Aug 2021 14:53:35 GMT Spranta 2021-08-13T14:53:35Z turn a columns with multiple entries into a chart https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563186#M100344 <P>Hello,<BR /><BR />I am pretty new to splunk, and just feel lost at times. I have a question that i cant seem to find an answer for.&nbsp;<BR />I have data that looks like&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="rite10privacy10_0-1628861075129.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15557i029E92CF24C46088/image-size/medium?v=v2&amp;px=400" role="button" title="rite10privacy10_0-1628861075129.png" alt="rite10privacy10_0-1628861075129.png" /></span></P><P>so the above is like 1 row and then there are multiple&nbsp; rows with the same type of list of entries for timestamp and total<BR /><BR />now I want to turn each row into a line on a line chart where the x-axis is the timestamp and the y-axis is the "Total". sort of like overlapping line charts based on all the rows.<BR /><BR />anyone have ideas&nbsp;</P> Fri, 13 Aug 2021 13:27:19 GMT https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563186#M100344 rite10privacy10 2021-08-13T13:27:19Z Re: turn a columns with multiple entries into a chart https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563190#M100345 <P>Hi, have you tried to expand the Multiple Value field with</P><P>| mvexand TimeStamp?</P> Fri, 13 Aug 2021 13:51:10 GMT https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563190#M100345 Spranta 2021-08-13T13:51:10Z Re: turn a columns with multiple entries into a chart https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563194#M100346 <P>Hello, So i have tried that the issue is tho and then i get a table that looks like this&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="rite10privacy10_0-1628863408501.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15558i372EC0BEE065FCF2/image-size/medium?v=v2&amp;px=400" role="button" title="rite10privacy10_0-1628863408501.png" alt="rite10privacy10_0-1628863408501.png" /></span></P><P><BR />so then i apply same thing to the Total columns and i get a bunch of duplicate rows, is there a way to delete all duplicate rows at that point?</P> Fri, 13 Aug 2021 14:04:06 GMT https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563194#M100346 rite10privacy10 2021-08-13T14:04:06Z Re: turn a columns with multiple entries into a chart https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563202#M100349 <P>Hello, So i have tried that the issue is tho and then i get a table that looks like this&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="rite10privacy10_0-1628864550808.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/15561i6F6143FE89DABBE0/image-size/medium?v=v2&amp;px=400" role="button" title="rite10privacy10_0-1628864550808.png" alt="rite10privacy10_0-1628864550808.png" /></span></P><P>&nbsp;</P><P><BR />so then i apply same thing to the Total columns and i get a bunch of duplicate rows, is there a way to delete all duplicate rows at that point?</P> Fri, 13 Aug 2021 14:22:37 GMT https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563202#M100349 rite10privacy10 2021-08-13T14:22:37Z Re: turn a columns with multiple entries into a chart https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563206#M100350 <P>yes, try</P><P>| dedup TimeStamp,Total</P> Fri, 13 Aug 2021 14:33:29 GMT https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563206#M100350 Spranta 2021-08-13T14:33:29Z Re: turn a columns with multiple entries into a chart https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563207#M100351 <LI-CODE lang="markup">| eval zipped=mvzip(TimeStamp,Total,"!") | mvexpand zipped | eval TimeStamp=mvindex(split(zipped,"!"),0) | eval Total=mvindex(split(zipped,"!"),1) | fields - zipped</LI-CODE> Fri, 13 Aug 2021 14:46:15 GMT https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563207#M100351 ITWhisperer 2021-08-13T14:46:15Z Re: turn a columns with multiple entries into a chart https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563209#M100352 <P>Great solution, just noticed that my solution has the issues that I'm dedupping the same results so this will lead to an incorrect total value</P> Fri, 13 Aug 2021 14:53:35 GMT https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563209#M100352 Spranta 2021-08-13T14:53:35Z Re: turn a columns with multiple entries into a chart https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563211#M100353 <P>you are a beautiful soul</P> Fri, 13 Aug 2021 14:56:42 GMT https://community.splunk.com/t5/Getting-Data-In/turn-a-columns-with-multiple-entries-into-a-chart/m-p/563211#M100353 rite10privacy10 2021-08-13T14:56:42Z