topic Re: Combine features from both stats and chart command in Splunk Search

Combine features from both stats and chart command

cmak — Mon, 25 Mar 2013 20:23:19 GMT

My fields in this example are (row, column, data and count)

I want to combine the features of this command:

chart sum(count) by row, column

This would make something like :

  column1 column2

row1 2 2
row2 3 1

with

stats sum(count) by row,data

This could create:
sum(count)
row1 data1 1
row1 data2 1
row2 data1 3
row2 data2 4

What I want is the combination:

           column1   column2

row1 data1 1 2
row1 data2 1 2
row2 data1 3 5
row2 data2 4 4

where the columns (column 1 and 2) are dynamic - All possible values of field column

In short, I would like to split by multiple fields, but also create a matrix with another particular field.

I suppose I could also try stats sum(eval(column="column1")), but I cannot find a way sum the count field with an eval statement. if there is a way to do this, I can dynamically generate the query with a long line of sum(eval) statements.

Re: Combine features from both stats and chart command

sideview — Tue, 26 Mar 2013 07:52:36 GMT

the xyseries command can turn a stats-style result set into the equivalent chart-style one, but since you can only specify one group-by field (the docs call it an x-field), you have to use eval to glom your unique combinations into a single field, wash it through xyseries, and then split it apart again after.

xyseries docs: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xyseries

Re: Combine features from both stats and chart command

cmak — Tue, 26 Mar 2013 16:37:18 GMT

This is great