topic Query Modification in Splunk Search

Query Modification

_gkollias — Mon, 28 Sep 2020 15:46:19 GMT

I have a search that tables project name, the group it belongs to, and the total count of deployment types:

index=eis_continuous_integration sourcetype=eisci
|search Group="EG"
| bucket span=1d _time as Date
| eval Date = strftime(Date, "%m/%d/%Y")
| stats count as total_deployment_count by SRCProject, Group

It's a nice table and all, but I'd like to create a column chart that displays the different project names on the x-axis, the group it belongs to on the left hand side (not just "Group", but "EG", etc.), and the total deployment count as the y-axis.

How can I modify this search so I get these results in a dashboard panel?

Thank You

Re: Query Modification

kristian_kolb — Thu, 30 Jan 2014 16:26:43 GMT

Hi,

Your query looks a bit odd. The search Group="EG" condition could be moved to before the first pipe. You do some calculations on time/date, but never use them...

Without having any sample data, it's bit hard to see what you want to do, but perhaps you are looking for something like this;

index=eis_continuous_integration sourcetype=eisci
| chart count as total_deployment_count over SRCProject by Group

Re: Query Modification

_gkollias — Thu, 30 Jan 2014 16:33:49 GMT

Thanks for pointing that out. I used a search I previously used and never removed it 🙂

That search helped, I really appreciate it!