https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374825#M110169 <P>Give this a try. (Remove some dead code, merged both searches to get output with single search [no subsearch])</P> <PRE><CODE> index=msahc sourcetype=msahc_raw | rex "(?&lt;json_field&gt;{[^}]+})" | mvexpand json_field | spath input=json_field | search ACT | rename "IDM Access" as "IDM_Access", "FACTS Database Access" as "FACTS_Database_Access" | table IDM_Access FACTS_Database_Access | eval temp=1 | untable temp FieldName Value | chart count over FieldName by Value </CODE></PRE> Tue, 22 Aug 2017 15:32:16 GMT somesoni2 2017-08-22T15:32:16Z https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374822#M110166 <P>I have the following query:</P> <PRE><CODE>index=msahc sourcetype=msahc_raw | rex "(?&lt;json_field&gt;{[^}]+})" | mvexpand json_field | spath input=json_field | search ACT | eval DateTime=_time | convert timeformat="%x" ctime(DateTime) | bucket DateTime span=1d | rename "IDM Access" as "IDM_Access", "FACTS Database Access" as "FACTS_Database_Access" | table IDM_Access | chart var(Field="IDM_Access") as Fields count(eval(IDM_Access=="False")) as False count(eval(IDM_Access=="True")) as True | append [search index=msahc sourcetype=msahc_raw | rex "(?&lt;json_field&gt;{[^}]+})" | mvexpand json_field | spath input=json_field | search ACT | eval DateTime=_time | convert timeformat="%x" ctime(DateTime) | bucket DateTime span=1d | rename "IDM Access" as "IDM_Access", "FACTS Database Access" as "FACTS_Database_Access" | table FACTS_Database_Access | chart var(Field="FACTS_Database_Access") as Fields count(eval(FACTS_Database_Access=="False")) as False count(eval(FACTS_Database_Access=="True")) as True] </CODE></PRE> <P>That generates the following bar chart:</P> <P><IMG src="https://community.splunk.com/storage/temp/209627-2017-08-22-10-54-27.jpg" alt="alt text" /></P> <P>How can I get the bar chart to display the name of the "Fields", such as IDM_Access and FACTS_Database_Access? </P> Tue, 29 Sep 2020 15:24:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374822#M110166 gcescatto 2020-09-29T15:24:53Z https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374823#M110167 <P>@gcescatto, <BR /> Please ensure to format the splunk search/code using code sample formatter (button about the editing area labeled <CODE>101010</CODE> or by using Ctrl+K key after selecting the code. </P> Tue, 22 Aug 2017 15:15:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374823#M110167 somesoni2 2017-08-22T15:15:41Z https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374824#M110168 <P>I did, but nothing changed...</P> Tue, 22 Aug 2017 15:27:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374824#M110168 gcescatto 2017-08-22T15:27:52Z https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374825#M110169 <P>Give this a try. (Remove some dead code, merged both searches to get output with single search [no subsearch])</P> <PRE><CODE> index=msahc sourcetype=msahc_raw | rex "(?&lt;json_field&gt;{[^}]+})" | mvexpand json_field | spath input=json_field | search ACT | rename "IDM Access" as "IDM_Access", "FACTS Database Access" as "FACTS_Database_Access" | table IDM_Access FACTS_Database_Access | eval temp=1 | untable temp FieldName Value | chart count over FieldName by Value </CODE></PRE> Tue, 22 Aug 2017 15:32:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374825#M110169 somesoni2 2017-08-22T15:32:16Z https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374826#M110170 <P>That worked perfectly! Thank you so much. I got the idea. Reducing redundancy makes the search way cleaner and way quicker. </P> Tue, 22 Aug 2017 15:37:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-X-axis-display-the-name-of-each-field/m-p/374826#M110170 gcescatto 2017-08-22T15:37:14Z