topic Display data on single bar line in chart in Splunk Search

Display data on single bar line in chart

rvisj — Fri, 26 May 2017 05:17:36 GMT

I have some records in csv, each record has a column 'payment method'. I have to count by 'payment method' and the result should how in single line in chart
Each color in chart represents a payment method

Re: Display data on single bar line in chart

adonio — Fri, 26 May 2017 14:01:22 GMT

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps

Re: Display data on single bar line in chart

woodcock — Fri, 26 May 2017 14:53:18 GMT

Like this:

Your Base Search Here | eval label="Payment Methods" | contingency label "payment method" | search label!="TOTAL"

Set the visualization to Bar Chart and set the Stack Mode to the one on the right (stacked).

Re: Display data on single bar line in chart

rvisj — Mon, 29 May 2017 06:49:29 GMT

Working..thanks @adonio. Can we remover that 'var 1' label from Y-axis

Re: Display data on single bar line in chart

rvisj — Mon, 29 May 2017 06:54:53 GMT

thanks for your reply. I tried this but 'Total' is coming as a payment method and adding up in the chart

Re: Display data on single bar line in chart

woodcock — Mon, 29 May 2017 15:45:47 GMT

Also add | fields - Total TOTAL to the end.