Split results from chart

nadeige1 — Thu, 15 Apr 2021 16:27:50 GMT

Hello,

I am using the chart command in order to display data using a line chart:

| chart values("torque") as variable over sort by HoleNb

But I get the following results:

Therefore, visualisation is not initialized properly. How do I split the results in order to have something like this?

sort	2941	2945	2946	2948	2950	2951	2952	2954	2955	2957	OTHER
50	2330	2180	2050	2180	2520	1740	2120	2830	2330	2050	1150
50	2890	2700	2700	3230	3290	2770	3360	2890	2520	2830	1210
50											1280
50											1340
50											1400
50											1490

Re: Split results from chart

scelikok — Thu, 15 Apr 2021 17:30:20 GMT

Hi @nadeige1,

Can you try with list function?

| chart list("torque") as variable over sort by HoleNb

Re: Split results from chart

ITWhisperer — Thu, 15 Apr 2021 17:49:11 GMT

Your issue is that chart values has create multi-value fields of different lengths. However, starting from the chart you have created, you could do something like this:

| makeresults | eval _raw="sort,2941,2945,2946,2948,2950,2951,2952,2954,2955,2957,OTHER 50,2330,2180,2050,2180,2520,1740,2120,2830,2330,2050,1150 50,2890,2700,2700,3230,3290,2770,3360,2890,2520,2830,1210 50,,,,,,,,,,,1280 50,,,,,,,,,,,1340 50,,,,,,,,,,,1400 50,,,,,,,,,,,1490 60,2335,2185,2055,2185,2525,1745,2125,2835,2335,2055,1155 60,2895,2705,2705,3235,3295,2775,3365,2895,2525,2835,1215 60,,,,,,,,,,,1285 60,,,,,,,,,,,1345 60,,,,,,,,,,,1405 60,,,,,,,,,,,1495" | multikv forceheader=1 | fields - _* linecount | untable sort HoleNb Torque | chart useother=f values(Torque) as Torque by sort HoleNb ``` The above creates a chart similar to yours. I added an extra sort value in case you actually have more than one row. ``` | streamstats count as row | foreach * [| eval mvc_<<FIELD>>=mvcount('<<FIELD>>')] | foreach mvc_* [| eval max_rows=if(isnull(max_rows),'<<FIELD>>',if('<<FIELD>>'>max_rows,'<<FIELD>>',max_rows))] | fields - mvc_* | streamstats sum(max_rows) as top_row | append [| makeresults | eval top_row=1 | eval row=1 | fields - _time] | makecontinuous top_row | sort - top_row | filldown | sort row top_row | streamstats count as mvrow by row | fields - max_rows row top_row | foreach * [| eval <<FIELD>>=if("<<FIELD>>"!="sort" AND "<<FIELD>>"!="mvrow",mvindex('<<FIELD>>',mvrow-1),'<<FIELD>>')] | fields - mvrow

topic Re: Split results from chart in Splunk Search

Split results from chart

Re: Split results from chart

Re: Split results from chart