topic Re: How to chart with multiple values on legend in Splunk Search

How to chart with multiple values on legend

Dherom — Tue, 03 Sep 2019 15:30:42 GMT

I want to have different values in the legend of a column and that the yaxis is a specific value of this legend.

sourcetype="securitycenter" asset=AMER_MS_SRV OR asset=EMEA_MS_SRV OR asset=APAC_MS_SRV 
|  rex field=asset "(?.*)_MS_SRV|"
|chart  eval(round(latest(crit),0)) as C by name |eval pos = case(name=="AMER","1",name=="EMEA","2",name=="APAC","3",name==name,"4") | sort pos| eval target=1 | table name, C, target

In this image I want to add Totips:totalvalue to legend and y-axis are "C".

Re: How to chart with multiple values on legend

tscroggins — Wed, 30 Sep 2020 01:58:55 GMT

Can you clarify your question? "Totips" isn't a field in your search. If you want to display e.g. "Totips: 19" in place of "C: 19" in the tooltip, then simply replace C with Totips in your search:

Re: How to chart with multiple values on legend

Dherom — Thu, 05 Sep 2019 08:46:14 GMT

I want add another value field 'totips' (on same char) and shown multiple values on same bar and this bar evaluated with 'C' field

thanks you for you answer

Re: How to chart with multiple values on legend

Dherom — Tue, 10 Sep 2019 08:45:26 GMT

i want other value to highligh linked.
Example

name:AMER
C:19
totips:890

but dont shown this bar(totips) in this panel. I did trellis values but i dont order by name, order by xaxys value(totips) and i want this.

Re: How to chart with multiple values on legend

tscroggins — Tue, 10 Sep 2019 13:55:23 GMT

I don't think you can do this in a column chart. The tooltip HTML is created from a single series using the point value (X,Y) under the mouse pointer.

Are you open to custom solutions, or are you restricted to pure SimpleXML?