topic Re: Creating multiple chart with labels in Splunk Search

Creating multiple chart with labels

dimitryz — Mon, 28 Sep 2020 16:56:07 GMT

Hello,

I've build following simple search from our client test data :
sourcetype=json_new | search browser_version browser_data | chart count by browser_version,browser_data

In this case browser_data is browser name like "IE" or "Firefox"

I can also get specific information per browser :
sourcetype=json_new | search browser_version browser_data="IE" | chart count by browser_version

Or get list of all browsers ;

sourcetype=json_new | spath browser_data | dedup browser_data | table browser_data

I would like to know how to build a single chart that contains all :
Per each browser all statistics regarding versions (browser_version) .

Thanks in advance ,
Dmitry

Re: Creating multiple chart with labels

aweitzman — Thu, 26 Jun 2014 14:35:29 GMT

Are you looking for something more like stats rather than chart?

sourcetype=json_new browser_version browser_data | stats count by browser_data,browser_version

What are "all statistics" that you are looking for, besides count?

Re: Creating multiple chart with labels

dimitryz — Thu, 26 Jun 2014 16:55:28 GMT

Stats is works too,but I'm interested to see count (statistics) for each browser in one search grouped by browser.
See "picture"

||| || ||| |||||
IE Firefox Opera

Each group of || is count of versions for each browser.
I hope that I was able to explain myself.

Re: Creating multiple chart with labels

aweitzman — Thu, 26 Jun 2014 19:06:16 GMT

I think you just want something similar to your first search, then, but with the output groups reversed:

sourcetype=json_new browser_version browser_data | chart count by browser_data, browser_version