topic Re: Legends in bar chart in Dashboards & Visualizations

Legends in bar chart

erkin — Mon, 18 Mar 2024 09:26:58 GMT

Hi, Im a novice to Splunk and i have a question regarding visualization.

I have my query like this:

|...myBaseQuery | chart c as "Count" by category

This results in me only having one legend in my visualization, "Count". I was wondering if there's any way to get the all the values as a legend on the right (see image) ?

I realized this is possible when i also use the retailUnit in the chart command:

|...myBaseQuery | chart c as "Count" by retailUnit category

Then I get one label for each category (see image), but i want to achieve this without sorting on retailUnit.

Is this possible?

Re: Legends in bar chart

ITWhisperer — Mon, 18 Mar 2024 09:54:44 GMT

Do you mean something like this

| eval static="Category" | chart count by static category

Re: Legends in bar chart

erkin — Mon, 18 Mar 2024 09:59:31 GMT

Yes! Exactly what I need, thank you.

Now the only issue I'm having is that I'm no longer available to sort the bar chart in descending order. Earlier I used to do | sort -count, but that doesn't seem to work using static

Re: Legends in bar chart

ITWhisperer — Mon, 18 Mar 2024 10:13:56 GMT

Yes, chart will sort the columns by name. In order to get around this, you need to use transpose