https://community.splunk.com/t5/Dashboards-Visualizations/chart-command/m-p/674256#M55205 <LI-CODE lang="markup">| eval merged=API."|".host."|".method | chart count over merged by StatusCode | addtotals | eval API=mvindex(split(merged,"|"),0) | eval host=mvindex(split(merged,"|"),1) | eval method=mvindex(split(merged,"|"),2) | fields - merged</LI-CODE> Mon, 15 Jan 2024 10:32:12 GMT ITWhisperer 2024-01-15T10:32:12Z https://community.splunk.com/t5/Dashboards-Visualizations/chart-command/m-p/674247#M55203 <P>HI All,</P><P>I need to display the results same as like below&nbsp;<BR /><BR /></P><P>|chart count over API by StatusCode&nbsp;</P><P>API&nbsp; 200 300 400 400 total<BR />--&nbsp; &nbsp;---&nbsp; &nbsp; &nbsp; ----&nbsp; &nbsp; &nbsp;--&nbsp; &nbsp; &nbsp; ---<BR />but I need to display the results behind API more fields like host and method as well</P><P>API host method 200 300 400&nbsp; total&nbsp;<BR />--&nbsp; &nbsp; &nbsp;---&nbsp; &nbsp; ---&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; --&nbsp; &nbsp; &nbsp; ---&nbsp; &nbsp; ----</P><P>please help to get the results</P> Mon, 15 Jan 2024 10:12:04 GMT https://community.splunk.com/t5/Dashboards-Visualizations/chart-command/m-p/674247#M55203 lucky 2024-01-15T10:12:04Z https://community.splunk.com/t5/Dashboards-Visualizations/chart-command/m-p/674256#M55205 <LI-CODE lang="markup">| eval merged=API."|".host."|".method | chart count over merged by StatusCode | addtotals | eval API=mvindex(split(merged,"|"),0) | eval host=mvindex(split(merged,"|"),1) | eval method=mvindex(split(merged,"|"),2) | fields - merged</LI-CODE> Mon, 15 Jan 2024 10:32:12 GMT https://community.splunk.com/t5/Dashboards-Visualizations/chart-command/m-p/674256#M55205 ITWhisperer 2024-01-15T10:32:12Z