topic Re: Chart over multiple fields in Dashboards & Visualizations

How to creat a chart over multiple fields?

NathanAsh — Thu, 03 Aug 2023 20:51:08 GMT

I need some thing like the following one as the final output

I have tried some thing like this...but not the one i expected...

....query | chart values(percent) over svc by ResponseCode

is it possible to include something like this, checked and its not working...

....query | chart values(percent) over Channel,svc by ResponseCode

Thanks

Re: Chart over multiple fields

gcusello — Fri, 14 Jul 2023 06:21:19 GMT

Hi @NathanAsh,

Splunk isn't Excel, so it isn't possible to exactly have this output.

You have only one workaround:

having the channel value in each row, in the same field of the ResponseCode:

| eval Column= Channel." - ".svc | chart values(percent) over Column by ResponseCode

Ciao.

Giuseppe

Re: Chart over multiple fields

ITWhisperer — Fri, 14 Jul 2023 08:05:17 GMT

Try something like this

| stats values(percent) as percent by Channel,svc,ResponseCode | eval {ResponseCode} = percent | fields - ResponseCode percent | stats values(*) as * by Channel,svc | fillnull value=0

Re: Chart over multiple fields

PickleRick — Fri, 14 Jul 2023 13:53:05 GMT

As @gcusello said - it doesn't work this way in Splunk. It's indeed not Excel, but that's not the _reason_. It's just that it's impossible to have such relationship between separate rows of results - in Splunk every result is an entity in its own rights so you can't "make" one result row to "stick" with another one.

Maybe - just maybe - someone did a custom visualization which merges cells on presentation but I doubt that.

You can use multivalue functions to simulate this behaviour to some extent but this functionality is very limited and doesn't allow for - for example - reordering several columns "together". It doesn't work well with "holes" in the results either.

Re: Chart over multiple fields

NathanAsh — Thu, 03 Aug 2023 16:02:21 GMT

Thanks, something better results

Re: Chart over multiple fields

gcusello — Fri, 04 Aug 2023 06:40:38 GMT

Hi @NathanAsh ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Chart over multiple fields

NathanAsh — Tue, 08 Aug 2023 19:38:24 GMT

Hi,

I have another query in connection with these queries output. Don't know whether to open another request or continue with this..

Let me brief the requirements here,

I am planning to create an alert based on the above query results, in that i need to include the trigger condition as response code 200's value less than 85% records to be mailed. how do I go about configuring the trigger condition. I am just trying search 200<85, yet to see the alert being generated.

Can you please help me with that?

Thanks

Re: Chart over multiple fields

gcusello — Wed, 09 Aug 2023 07:34:49 GMT

Hi @NathanAsh ,

it's always better to open a new question to have a quicker and maybe better answer.

Always remember to accept one answer for te other people of the Community and giving Karma Points to all the Contributors.

Anyway, I hint to insert the condition in the alert search and configure your alert when there are results.

Ciao.

Giuseppe

Re: Chart over multiple fields

NathanAsh — Wed, 09 Aug 2023 14:22:53 GMT

Hi,

Thanks. Yes, finally I did that already its working fine. Even that search custom query was working , it got messed up in the mail filtering rules. Thanks for your suggestions .