https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-field-after-using-the-chart-command/m-p/181156#M52230 <P><EM>EDIT</EM> - second time's the charm. </P> <PRE><CODE>index=foo conversion_source=Online OR conversion_source=Offline | bin span=1w _time | chart sum(ABC) AS ABC sum(DEF) AS DEF sum(GHI) AS GHI sum(JKL) AS JKL over _time by conversion_source | untable date type count </CODE></PRE> Fri, 20 Mar 2015 02:38:31 GMT sideview 2015-03-20T02:38:31Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-field-after-using-the-chart-command/m-p/181155#M52229 <P>Hi Ninjas,</P> <P>I have a search which produces a bar chart comparing four different fields week over week:</P> <PRE><CODE>index=foo conversion_source=Online OR conversion_source=Offline | bin span=1w _time | chart sum(ABC) AS ABC sum(DEF) AS DEF sum(GHI) AS GHI sum(JKL) AS JKL over _time by conversion_source | transpose | search column!=_* | rename "row 1" AS "Current Week" "row 2" AS "Past Week" column AS "Conversion Source" </CODE></PRE> <P>Here is the bar chart:<BR /> <span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/280i6C9FD18D24072FBF/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> <P>It is ok but the customer wants something a little fancier, like a Bubble Chart or a Punchcard, e.g.<BR /> <span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/281i79D94EBFEA88F0E1/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> <P>To use the Punchard viz, I need to re-format the output from the following:</P> <PRE><CODE>Conversion Source Current Week Past Week ABC: Offline 40262 37334 ABC: Online 36997 36233 DEF: Offline 253865 216674 DEF: Online 561871 572597 GHI: Offline 356971 398079 GHI: Online 243909 226444 JKL: Offline 1275880 1284603 JKL: Online 1225050 1165302 </CODE></PRE> <P>to this:</P> <PRE><CODE>date type count Current Week ABC: Offline 40262 Current Week ABC: Online 36997 Current Week DEF: Offline 253865 Current Week DEF: Online 561871 Current Week GHI: Offline 356971 Current Week GHI: Online 243909 Current Week JKL: Offline 1275880 Current Week JKL: Online 1225050 Past Week ABC: Offline 37334 Past Week ABC: Online 36233 Past Week DEF: Offline 216674 Past Week DEF: Online 572597 Past Week GHI: Offline 398079 Past Week GHI: Online 226444 Past Week JKL: Offline 1284603 Past Week JKL: Online 1165302 </CODE></PRE> <P>I would greatly appreciate any tips on how to achieve this new tabular output.</P> <P>Thanks in advance,</P> <P>Luke.</P> Fri, 20 Mar 2015 00:32:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-field-after-using-the-chart-command/m-p/181155#M52229 lukeh 2015-03-20T00:32:46Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-field-after-using-the-chart-command/m-p/181156#M52230 <P><EM>EDIT</EM> - second time's the charm. </P> <PRE><CODE>index=foo conversion_source=Online OR conversion_source=Offline | bin span=1w _time | chart sum(ABC) AS ABC sum(DEF) AS DEF sum(GHI) AS GHI sum(JKL) AS JKL over _time by conversion_source | untable date type count </CODE></PRE> Fri, 20 Mar 2015 02:38:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-field-after-using-the-chart-command/m-p/181156#M52230 sideview 2015-03-20T02:38:31Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-field-after-using-the-chart-command/m-p/181157#M52231 <P>Thank you Nick!!!11!!!!!1!!!</P> <P>untable did the trick, which reminds me of the undead <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Fri, 20 Mar 2015 05:06:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-new-field-after-using-the-chart-command/m-p/181157#M52231 lukeh 2015-03-20T05:06:55Z