<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Dashboard in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635450#M52074</link>
    <description>&lt;P&gt;There are mixed messages in your requirement - the example table you have shown gives the first column as age groups with dates as the subsequent columns, whereas the SPL and the screenshot would be give the first column as dates and subsequent columns as age groups.&lt;/P&gt;&lt;P&gt;For the first table, try this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;|inputlookup september.csv
|eval _time=strptime("2022-09-01","%Y-%m-%d")
|append [|inputlookup july.csv
|eval _time=strptime("2022-07-01","%Y-%m-%d")]
| chart count by "Age Group" _time&lt;/LI-CODE&gt;&lt;P&gt;For the screenshot, try this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;|inputlookup september.csv
|eval _time=strptime("2022-09-01","%Y-%m-%d")
|append [|inputlookup july.csv
|eval _time=strptime("2022-07-01","%Y-%m-%d")]
| chart count by _time "Age Group"&lt;/LI-CODE&gt;</description>
    <pubDate>Wed, 22 Mar 2023 06:26:58 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2023-03-22T06:26:58Z</dc:date>
    <item>
      <title>How to create a Dashboard?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635440#M52073</link>
      <description>&lt;P&gt;Hi Splunkers,&lt;/P&gt;
&lt;P&gt;I’m working on a Dashboard panel where I have to create a monthly wise data as shown in the screenshot.&amp;nbsp;&lt;BR /&gt;I have a field called “age group” and corresponding month’s data. But every month’s data comes from an external lookup file.&lt;/P&gt;
&lt;P&gt;Data for example:&lt;/P&gt;
&lt;P&gt;&lt;BR /&gt;Age Group &amp;nbsp; &amp;nbsp;Sept &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;July &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;Jun&lt;/P&gt;
&lt;P&gt;30-90 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;235 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;0 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; 34&lt;/P&gt;
&lt;P&gt;90-180 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;1757 &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;2168 &amp;nbsp; &amp;nbsp; 3467&lt;/P&gt;
&lt;P&gt;180+ &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;19374 &amp;nbsp; &amp;nbsp; 20,534 &amp;nbsp;12,661&lt;BR /&gt;&lt;SPAN&gt;&amp;nbsp;I’m using this below code but it’s not actually working for me. Please help me with the logic to produce the chart like as it was in the screenshot. TIA&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;BR /&gt;|inputlookup september.csv&lt;BR /&gt;|stats count by "Age Group"&lt;BR /&gt;|eval _time=strptime("2022-09-01","%Y-%m-%d")&lt;BR /&gt;|append [|inputlookup july.csv&lt;BR /&gt;|stats count by "Age Group"&lt;BR /&gt;|eval _time=strptime("2022-07-01","%Y-%m-%d")]&lt;/P&gt;
&lt;P&gt;…&lt;/P&gt;
&lt;P&gt;|chart count by _time, “Age Group”&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2023 20:28:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635440#M52073</guid>
      <dc:creator>revanthammineni</dc:creator>
      <dc:date>2023-03-22T20:28:24Z</dc:date>
    </item>
    <item>
      <title>Re: Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635450#M52074</link>
      <description>&lt;P&gt;There are mixed messages in your requirement - the example table you have shown gives the first column as age groups with dates as the subsequent columns, whereas the SPL and the screenshot would be give the first column as dates and subsequent columns as age groups.&lt;/P&gt;&lt;P&gt;For the first table, try this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;|inputlookup september.csv
|eval _time=strptime("2022-09-01","%Y-%m-%d")
|append [|inputlookup july.csv
|eval _time=strptime("2022-07-01","%Y-%m-%d")]
| chart count by "Age Group" _time&lt;/LI-CODE&gt;&lt;P&gt;For the screenshot, try this:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;|inputlookup september.csv
|eval _time=strptime("2022-09-01","%Y-%m-%d")
|append [|inputlookup july.csv
|eval _time=strptime("2022-07-01","%Y-%m-%d")]
| chart count by _time "Age Group"&lt;/LI-CODE&gt;</description>
      <pubDate>Wed, 22 Mar 2023 06:26:58 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635450#M52074</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2023-03-22T06:26:58Z</dc:date>
    </item>
    <item>
      <title>Re: Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635451#M52075</link>
      <description>&lt;P&gt;yeah, I’m trying to achieve the screen shot. But the &amp;nbsp;you’ve mentioned isn’t working unfortunately.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2023 06:31:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635451#M52075</guid>
      <dc:creator>revanthammineni</dc:creator>
      <dc:date>2023-03-22T06:31:06Z</dc:date>
    </item>
    <item>
      <title>Re: Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635452#M52076</link>
      <description>&lt;P&gt;In what way is it not working?&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2023 06:32:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635452#M52076</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2023-03-22T06:32:56Z</dc:date>
    </item>
    <item>
      <title>Re: Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635455#M52077</link>
      <description>&lt;P&gt;&lt;EM&gt;returning all 1’s in the statistics&amp;nbsp;&lt;/EM&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2023 06:51:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635455#M52077</guid>
      <dc:creator>revanthammineni</dc:creator>
      <dc:date>2023-03-22T06:51:53Z</dc:date>
    </item>
    <item>
      <title>Re: Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635457#M52079</link>
      <description>&lt;P&gt;OK, it sounds like your actual data already has the counts in?&lt;/P&gt;&lt;P&gt;This means that your example search would also have returned 1's&lt;/P&gt;&lt;P&gt;Try summing the counts (assuming the count column in your csv is called "count")&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;|inputlookup september.csv
|eval _time=strptime("2022-09-01","%Y-%m-%d")
|append [|inputlookup july.csv
|eval _time=strptime("2022-07-01","%Y-%m-%d")]
| chart sum(count) by _time "Age Group"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;It is often helpful and less time-consuming if you provide as much information about your problem as possible so we are not left guessing and end up providing incorrect solutions based on false assumptions.&lt;/P&gt;</description>
      <pubDate>Wed, 22 Mar 2023 06:59:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-Dashboard/m-p/635457#M52079</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2023-03-22T06:59:57Z</dc:date>
    </item>
  </channel>
</rss>

