topic Re: Can you have 3 fields within a chart in Splunk Search

Can you have 3 fields within a chart

zoebanning — Mon, 08 Nov 2021 00:49:05 GMT

Hi Splunk Community,

I was wondering if it was possible to have a chart that was made up from 3 fields....

I have already built a chart that has columns for each Account where each column is stacked with the Action --> | chart count by Account, Action

Can i break down into days using the _time field, so it counts by days?

Example of data:

_time	Account	Action
2021-10-20 10:04:03.778	account1	Delete
2021-10-21 11:04:03.778	account2	Write
2021-10-21 11:05:03.778	account1	Write

Thanks You,

Zoe

Re: Can you have 3 fields within a chart

bhargavi — Mon, 15 Nov 2021 13:32:29 GMT

Hi @zoebanning ,

Chart command does not allow more than 2 fields in by clause
Timechart command does not allow more than 1 field in by clause

So here I have tried to display the possible values of account and action and merged them into 1 column, then used timechart command .

If this helps, give a thumbs-up 🙂
Happy Splunking!!

Re: Can you have 3 fields within a chart

NobliX — Sat, 24 Dec 2022 11:57:30 GMT

Regarding the chart. Is there a possibility to hide or remove a column in the column chart based on nullvalue. (The space created visually) ? As of now it is created spaces to 3 bars, thus its only displaying the value of given instance.