topic Re: Using Chart over two fields grouped by time in Splunk Search

Using Chart over two fields grouped by time

kabiraj — Wed, 04 Nov 2015 12:11:57 GMT

Hi Guys,

I am trying to pull up a table containing Time, Channel & Popularity as fields.

I am using : chart useother=f max(position) over Channel by Time

Above gives me only Channel & Time as fields in the table but i want Channel, Popularity & Time as fields.

I tried : chart useother=f max(position) over Channel Popularity by Time

But failed as it showed a syntax error.

Below is a sample of result

Channel 03-Nov-15 04-Nov-15
Watch 27 29
Universal 14 15
TLC HD 54 64
TLC 21 20

I want Popularity to be added besides the Channel field

Any Ideas?

Re: Using Chart over two fields grouped by time

woodcock — Wed, 04 Nov 2015 14:10:48 GMT

Like this:

... | eval Channel_and_Popularity = Channel . ":" . Popularity | chart useother=f max(position) OVER Channel_and_Popularity BY Time

Re: Using Chart over two fields grouped by time

kabiraj — Thu, 05 Nov 2015 05:56:58 GMT

Hi Woodcock! Thanks for your prompt response but i want Channel & Popularity as two different fields instead of appending it into one delimited by ":".

Below is the example :

Channel Name Popularity 04-Nov-15 05-Nov-15
1 Sky Movies Premiere 1 78 74
2 Sky Movies Showcase 2 82 71
3 Sky Movies Greats 3 80 72
4 Sky Movies Disney 4 77 66
5 Sky Movies Family 5 81 75
6 Sky Movies Action & Adventure 6 79 60

Any other suggestions will be highly appreciated. 🙂

Re: Using Chart over two fields grouped by time

woodcock — Thu, 05 Nov 2015 13:44:51 GMT

Like this:

 ... | eval = Channel . ":" . Popularity | chart useother=f max(position) OVER Channel_and_Popularity BY Time | rex field=Channel_and_Popularity "(?<Channel >[^:]+):(?<Popularity >[^:]+)" | fields Channel Popularity *-*

Re: Using Chart over two fields grouped by time

kabiraj — Fri, 06 Nov 2015 05:50:58 GMT

Works like a Charm! Thank you! I think the Combination & splitting of fields and *-* did the trick. Thanks for sharing your expertise.
Just wanted to ask can we show N number of fields in the table just by giving *-* in the query?

Re: Using Chart over two fields grouped by time

woodcock — Fri, 06 Nov 2015 16:00:59 GMT

Yes, but they must be 1-to-1 (In other words each value deterministically maps to a single value in each of the joined fields).