topic Column chart based on field value, without everything being the "count" field in Splunk Search

Column chart based on field value, without everything being the "count" field

jwiley_splunk — Mon, 25 Mar 2019 13:41:15 GMT

Currently having a hard time figuring out how to create a column chart where the field values show up in the side, so I can color code them in XML.

My query is bringing back the results into a table, which I then pipe into a count command to create this column chart. The chart is exactly the info I want to see, I just can't figure out how to make color code it, since it's all the "count" field in XML.

| Parent search query
| table Name, (other fields)
| stats count by Name

I've looked all over, but just can't figure it out.

Re: Column chart based on field value, without everything being the "count" field

renjith_nair — Mon, 25 Mar 2019 14:18:42 GMT

@jwiley_splunk ,

Try transpose ing it

| Parent search query
| table Name, (other fields)
| stats count by Name
| transpose 0 header_field=Name

Re: Column chart based on field value, without everything being the "count" field

jwiley_splunk — Mon, 25 Mar 2019 14:45:44 GMT

That's almost perfect!

Is there a way to get the original labels back under the columns?

Re: Column chart based on field value, without everything being the "count" field

renjith_nair — Mon, 25 Mar 2019 14:59:46 GMT

@jwiley_splunk ,
Try this and select "stacked" in the format

 | Parent search query
 | table Name, (other fields)
 | eval _tmp=Name
 | chart count over Name by _tmp

Re: Column chart based on field value, without everything being the "count" field

jwiley_splunk — Mon, 25 Mar 2019 15:10:36 GMT

You're a saint. Thank you so much Renjith!