topic Re: Chart over time by multiple fields in Splunk Search

Chart over time by multiple fields

YuliyaVassilyev — Thu, 12 Dec 2024 15:29:44 GMT

Hi there! I want to create a scorecard by Manager and Region counting my Orders over Month. So the chart would look something like:

YuliyaVassilyev_0-1734017277904.png

I have all the fields: Region, Director, Month and Order_Number to make a count. Please let me know if you have an efficient way to do this in SPL. Thank you very much!

Re: Chart over time by multiple fields

gcusello — Thu, 12 Dec 2024 15:38:08 GMT

Hi @YuliyaVassilyev ,

at first Splunk isn't Excel!

anyway you could try something like this:

then to add partial totals.

Ciao.

Giuseppe

Re: Chart over time by multiple fields

YuliyaVassilyev — Thu, 12 Dec 2024 16:23:01 GMT

@gcusello that worked great, thank you. Do you also happen to know the best way to add the totals for each carrier like on line 5 and 9 on my example chart? Like appendpipe?

Re: Chart over time by multiple fields

gcusello — Fri, 13 Dec 2024 07:23:49 GMT

Hi @YuliyaVassilyev ,

in Community, there are many solutions to your request, see at

https://community.splunk.com/t5/Splunk-Search/How-do-I-combine-subtotals-and-totals-in-a-search-query/m-p/391298

https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-search-to-get-both-subtotals-and-the-grand/m-p/240503

https://community.splunk.com/t5/Splunk-Search/Show-subtotals-in-results-table/m-p/102875

https://community.splunk.com/t5/Splunk-Search/How-to-add-sub-totals-to-a-table/m-p/317028

Test them.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Chart over time by multiple fields

gcusello — Fri, 13 Dec 2024 12:47:00 GMT

Hi @YuliyaVassilyev ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉