topic Re: Splunk Charting Data Based on Type in Dashboards & Visualizations

Splunk Charting Data Based on Type

naralkar — Thu, 26 Nov 2020 07:37:25 GMT

I have derived data from Splunk in the following format (Actual Format). But I want to format furthermore it in such a way that I can see which items are present in which categories, and which are missing (Expected Format). I am trying to chart it based on categoryID, but it's not working for me as I do not think max function is appropriate for this. Can anyone please help me know how can I achieve this

Tried using

| chart max(itemId) over itemId by categoryID

Expected Format

Expected Format

Actual Format

Actual Data

Re: Splunk Charting Data Based on Type

to4kawa — Thu, 26 Nov 2020 08:39:35 GMT

| makeresults count=30 | eval categoryID=mvindex(split("Strategy,Archade",","),random() % 2) | eval itemId="EST-1".(random() % 9 + 1) | rex "(?<Comment>(?# this is your actual result, check this. from here, the logic))" | xyseries itemId categoryID itemId

Re: Splunk Charting Data Based on Type

naralkar — Thu, 26 Nov 2020 10:59:09 GMT

Thanks @to4kawa . This was all I needed..