topic Re: Column Chart Stacked based on 4 columns(column 1 has duplicate because of group by 2nd column) in Splunk Search

Column Chart Stacked based on 4 columns(column 1 has duplicate because of group by 2nd column)

rajg369 — Thu, 16 Dec 2021 16:22:39 GMT

e.g query

chart looks like

Question: instead of 2 stacked column ABC, i wanted 1 column(ABC) with 4 stacked values(1000,3215,478,4328) and FSD column with 2 stacked values as it is now

Please help

Re: Column Chart Stacked based on 4 columns(column 1 has duplicate because of group by 2nd column)

ITWhisperer — Thu, 16 Dec 2021 16:55:15 GMT

| makeresults | eval application="FSD", val_1="A", val_2=4839, val_3=5000 | append [| makeresults | eval application="ABC", val_1="B", val_2=1000, val_3=3215] | append [| makeresults | eval application="ABC", val_1="E", val_2=478, val_3=4328] | table application val_1 val_2 val_3 | sort application | streamstats count by application | foreach val_* [| eval name="copy_<<FIELD>>_".count | eval {name}=<<FIELD>>] | stats values(copy_*) as * by application

Re: Column Chart Stacked based on 4 columns(column 1 has duplicate because of group by 2nd column)

rajg369 — Fri, 17 Dec 2021 07:15:28 GMT

Thanks ITWhisperer. It works.

One more question on the same topic. How can I show Val_1(A/B/E...) in tooltip/legend?

This will help in understanding from the stacked column chart that the
value 1000 is from Application ABC and from B
value 479 is from Application ABC and from E

right now it shows application and val_>2_x(pls refer image below) in both tooltip and legend

Please help

Re: Column Chart Stacked based on 4 columns(column 1 has duplicate because of group by 2nd column)

ITWhisperer — Fri, 17 Dec 2021 10:22:33 GMT

| makeresults | eval application="FSD", val_1="A", val_2=4839, val_3=5000 | append [| makeresults | eval application="ABC", val_1="B", val_2=1000, val_3=3215] | append [| makeresults | eval application="ABC", val_1="E", val_2=478, val_3=4328] | table application val_1 val_2 val_3 | sort application | streamstats count by application | eventstats list(val_1) as val_1 by application | foreach val_* [| eval name="copy_<<FIELD>> ".mvindex(val_1,count-1) | eval {name}=<<FIELD>>] | stats values(copy_*) as * by application | fields - val_1*

Re: Column Chart Stacked based on 4 columns(column 1 has duplicate because of group by 2nd column)

rajg369 — Wed, 22 Dec 2021 14:06:15 GMT

Hi ITWhisperer,

All works fine. The problem now i have is val_4 is also stacked, i don't want val_4 to be stacked or plotted in chart, i just want to show val_4 in tool tip along with the existing tooltip

e.g scenario
Application: ABC
val_2_B is the total time taken to process
val_4: is the total count of val_2_B items that was processed [expected to show in tooltip and same should not be plotted in chart]

Please let me know if i am not clear

| makeresults
| eval application="FSD", val_1="A", val_2=4839, val_3=5000, val_4=1000
| append
[| makeresults
| eval application="ABC", val_1="B", val_2=1000, val_3=3215,val_4=2000]
| append
[| makeresults
| eval application="ABC", val_1="E", val_2=478, val_3=4328,val_4=3000]
| table application val_1 val_2 val_3 val_4
| sort application
| streamstats count by application
| eventstats list(val_1) as val_1 by application
| foreach val_*
[| eval name="copy_<<FIELD>> ".mvindex(val_1,count-1)
| eval {name}=<<FIELD>>]
| stats values(copy_*) as * by application
| fields - val_1*