topic Bar chart with multiple series in Splunk Search https://community.splunk.com/t5/Splunk-Search/Bar-chart-with-multiple-series/m-p/524407#M147929 <P>Hello,</P><P>I have the following data</P><P>book="title1" reader="reader1"<BR />book="title1" reader="reader1"<BR />book="title1" reader="reader2"<BR />book="title1" reader="reader2"<BR />book="title2" reader="reader1"<BR />book="title2" reader="reader3"<BR />book="title2" reader="reader3"<BR />book="title2" reader="reader3"<BR />...</P><P>&nbsp;</P><P>I'd like to represent it in a multi-series bar chart showing number of reads by reader per title as in a drawing below:</P><P>count<BR />^<BR />|&nbsp; &nbsp;_____________&nbsp; &nbsp; &nbsp;_____________<BR />|&nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|<BR />|&nbsp; &nbsp;|_reader1_____|&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|<BR />|&nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp;|_reader3_____ |<BR />|&nbsp; &nbsp;|_reader2_____|&nbsp; &nbsp; &nbsp;|_reader1_____ |<BR />----------------------------------------------------&gt; titles<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;title1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;title 2</P> Tue, 13 Oct 2020 13:16:33 GMT pitmod 2020-10-13T13:16:33Z Bar chart with multiple series https://community.splunk.com/t5/Splunk-Search/Bar-chart-with-multiple-series/m-p/524407#M147929 <P>Hello,</P><P>I have the following data</P><P>book="title1" reader="reader1"<BR />book="title1" reader="reader1"<BR />book="title1" reader="reader2"<BR />book="title1" reader="reader2"<BR />book="title2" reader="reader1"<BR />book="title2" reader="reader3"<BR />book="title2" reader="reader3"<BR />book="title2" reader="reader3"<BR />...</P><P>&nbsp;</P><P>I'd like to represent it in a multi-series bar chart showing number of reads by reader per title as in a drawing below:</P><P>count<BR />^<BR />|&nbsp; &nbsp;_____________&nbsp; &nbsp; &nbsp;_____________<BR />|&nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|<BR />|&nbsp; &nbsp;|_reader1_____|&nbsp; &nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|<BR />|&nbsp; &nbsp;|&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |&nbsp; &nbsp; &nbsp;|_reader3_____ |<BR />|&nbsp; &nbsp;|_reader2_____|&nbsp; &nbsp; &nbsp;|_reader1_____ |<BR />----------------------------------------------------&gt; titles<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;title1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;title 2</P> Tue, 13 Oct 2020 13:16:33 GMT https://community.splunk.com/t5/Splunk-Search/Bar-chart-with-multiple-series/m-p/524407#M147929 pitmod 2020-10-13T13:16:33Z Re: Bar chart with multiple series https://community.splunk.com/t5/Splunk-Search/Bar-chart-with-multiple-series/m-p/524421#M147931 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/224939">@pitmod</a>&nbsp;,<BR /><BR />Should work with this simple SPL:<BR /><BR /></P><LI-CODE lang="markup">| chart count by book, reader</LI-CODE><P><BR /><BR /><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="book_title.PNG" style="width: 990px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11269i66B419348D49A375/image-size/large?v=v2&amp;px=999" role="button" title="book_title.PNG" alt="book_title.PNG" /></span><BR /><BR />BR<BR />Ralph</P> Tue, 13 Oct 2020 13:49:24 GMT https://community.splunk.com/t5/Splunk-Search/Bar-chart-with-multiple-series/m-p/524421#M147931 rnowitzki 2020-10-13T13:49:24Z Re: Bar chart with multiple series https://community.splunk.com/t5/Splunk-Search/Bar-chart-with-multiple-series/m-p/524424#M147932 <LI-CODE lang="markup">| makeresults | eval _raw="book,reader title1,reader1 title1,reader1 title1,reader2 title1,reader2 title2,reader1 title2,reader3 title2,reader3 title2,reader3" | multikv forceheader=1 | stats count by book,reader | chart values(count) as count over book by reader</LI-CODE><UL><LI>use column chart</LI><LI>under format in general set "stacked" to stack mode</LI></UL><P>Note: stacked is middle option of stack mode.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="thambisetty_0-1602597042294.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11270iBD5D93FF71F4C1A6/image-size/medium?v=v2&amp;px=400" role="button" title="thambisetty_0-1602597042294.png" alt="thambisetty_0-1602597042294.png" /></span></P><P>&nbsp;</P> Tue, 13 Oct 2020 13:50:49 GMT https://community.splunk.com/t5/Splunk-Search/Bar-chart-with-multiple-series/m-p/524424#M147932 thambisetty 2020-10-13T13:50:49Z