topic Re: Why cant I chart over multiple fields? in Splunk Search

Why cant I chart over multiple fields?

bmgilmore — Mon, 22 Oct 2012 00:45:22 GMT

I would imagine it could return multivalue fields, but there could be advantages to being able to chart sum(foo) over _time, field1, field2 by field3. Could mimic a regular pivot table in the right scenario. Is this possible using some other method?

Thanks in advance!

Re: Why cant I chart over multiple fields?

Lucas_K — Mon, 22 Oct 2012 03:41:53 GMT

So it's a multidimensional chart your trying to create?

There is a nice time chart solution provided here : http://splunk-base.splunk.com/answers/59045/how-do-i-make-a-multi-dimension-timechart

Re: Why cant I chart over multiple fields?

bmgilmore — Mon, 22 Oct 2012 11:06:29 GMT

thanks, take for example (just an example, Im not splunking fruit):

timestamp=10/21/2008 04:16:31 Product=Apples Type=Macintosh key3=purchase value=31 units=dollars

timestamp=10/21/2008 04:18:41 Product=Apples Type=Granny key3=purchase value=118 units=dollars

timestamp=10/21/2008 05:19:30 Product=Apples Type=Macintosh key3=sale value=161 units=dollars

timestamp=10/21/2008 07:48:08 Product=Oranges Type=Navel key3=purchase value=18 units=dollars

I am unable figure out how to (even in a basic table) say: chart sum(value) over Product, Type by key3

Id like to maintain columns for each kv if possible as well for sorting and exporting.

Re: Why cant I chart over multiple fields?

Ayn — Mon, 22 Oct 2012 11:29:15 GMT

stats could be your friend here.

Re: Why cant I chart over multiple fields?

bmgilmore — Mon, 22 Oct 2012 14:48:27 GMT

Thanks, I can see a row based estimation on as many fields as I want to report on with stats, but what I really need is the columnar format of chart for example:

Product////////Type////////purchase////////sale
Apples/////////Macintosh///31//////////////161
Apples/////////Granny//////118/////////////0
Oranges////////Navel///////18//////////////0

If I use stats, I still need to use xyseries as far as I know and this still only allows for a single x value. Right now Im staging out the additional columns into a file via outputlookup and then joining them back in, but thats too complex. Thanks!