topic Re: Serial numbers for chart in Dashboards & Visualizations

Serial numbers for chart

srikarbaswa446 — Tue, 19 Sep 2017 10:42:20 GMT

How to get a serial number for chart in Splunk?
S_no
1
2
3
4
** in a chart ** ?
Thanks in advance

Re: Serial numbers for chart

srikarbaswa446 — Tue, 19 Sep 2017 10:43:48 GMT

Especially in a query written for a CHART only

Re: Serial numbers for chart

cmerriman — Tue, 19 Sep 2017 12:05:14 GMT

can you be more specific? is there other data you're using in conjunction with this? more details will help the community give a more helpful answer

Re: Serial numbers for chart

Sukisen1981 — Tue, 19 Sep 2017 12:19:26 GMT

you are looking for row count probably. try this -
| streamstats count as "S_no"

Re: Serial numbers for chart

srikarbaswa446 — Tue, 19 Sep 2017 12:35:44 GMT

Thank you but i need it in a separate coloum from my other output values

Re: Serial numbers for chart

srikarbaswa446 — Tue, 19 Sep 2017 12:36:30 GMT

serial number of each row in separate coloum

Re: Serial numbers for chart

srikarbaswa446 — Tue, 19 Sep 2017 12:48:27 GMT

Yeah , Actually in a eval statement i have specified numbers for each string so that i'll get in that sequence of numbers but now i need serial number in the same sequence by removing numbers assigned to string in eval statment

|eval hour=case(hour>0 AND hour<=6,"Midnight to 6AM",hour>6 AND hour<=8,"2. 6AM to 8AM",hour>8 AND hour<=10,"3. 8AM to 10AM",hour>10 AND hour<=12,"4. 10AM to 12PM",hour>12 AND hour<=14,"5. 12PM to 2PM",hour>14 AND hour<=16,"2PM to 4PM",hour>16 AND hour<=18,"4PM to 6PM",hour>18 AND hour<=20,"8. 6PM to 8PM",hour>20 AND hour<=24,"9. 8PM to Midnight")
|chart sum(count) by hour,wday

Re: Serial numbers for chart

cmerriman — Tue, 19 Sep 2017 12:55:45 GMT

if you add this to the end of your SPL, is it what you're looking for:

...|chart count by hour,wday|rex field=hour "(?<s_no>\d\.)"|rex mode=sed field=hour "s/\d\.//g"

Re: Serial numbers for chart

srikarbaswa446 — Tue, 19 Sep 2017 13:12:05 GMT

Thank you ,but serial number is getting populated in last coloumn

Re: Serial numbers for chart

Sukisen1981 — Tue, 19 Sep 2017 13:14:20 GMT

hi , you just need to use | Fields A,B,C in the order your need them to appear

Re: Serial numbers for chart

Sukisen1981 — Tue, 19 Sep 2017 13:15:29 GMT

hi , you just need to use | Fields A,B,C in the order your need them to appear

| Fields s_no, field1,field2 etc etc..

Re: Serial numbers for chart

srikarbaswa446 — Tue, 19 Sep 2017 13:54:09 GMT

am getting values in a stack mode ..needed like a chart

Re: Serial numbers for chart

Sukisen1981 — Tue, 19 Sep 2017 16:39:58 GMT

sorry not clear , you are getting a stacked chart? can you share a bit more with images what you desire and what you are getting?