topic Re: to get fields in bar chart in Splunk Search

to get fields in bar chart

sahana — Thu, 08 Feb 2024 05:07:56 GMT

I have a search query statistical result values in the below format

Login mode	Total login
xxx	48
Yyyy	23
aaa	52
bbbb	73

Now I need to display a bar chart which shows the login in respective of the login mode and the time selection in the query

for example:

Re: to get fields in bar chart

yuanliu — Thu, 08 Feb 2024 05:24:37 GMT

You mean something like this?

| timechart count by "Login mode"

Re: to get fields in bar chart

sahana — Thu, 08 Feb 2024 05:51:05 GMT

It is supposed to be a bar chart y axis denotes the login count and x- axis represents the time period selection we do in our search.... Those bars are representation of total count values of xxx,yyyy,aaa,bbb

Re: to get fields in bar chart

yuanliu — Thu, 08 Feb 2024 07:00:44 GMT

What do you mean by "total count"? There is only one total in my vocabulary. That's the opposite of the mockup chart in your original post that shows multiple bars at each depicted time point. If you don't need to break down, all you need is

| timechart count