All Apps and Add-ons

Basic Chart Issue

edschembor
Path Finder

So, I'm probably blanking on something, but I'm just trying to create a bar chart for a single value. So:

index=hpov eph " error " AND (tag="EPH_SVR") | chart count

But for some reason the bar graph won't appear. The reason I'm doing this is that I then have a larger search which appends columns, and for some reason, the first value (error count) won't appear as a bar and instead appears as the x-axis.

Thanks for the help!

0 Karma
1 Solution

somesoni2
Revered Legend

For plotting a chart your need 2 columns for both x an y axis. You search is producing just one.

Try something like this

index=hpov eph " error " AND (tag="EPH_SVR") | eval metric="Errors" | chart count by metric

View solution in original post

somesoni2
Revered Legend

For plotting a chart your need 2 columns for both x an y axis. You search is producing just one.

Try something like this

index=hpov eph " error " AND (tag="EPH_SVR") | eval metric="Errors" | chart count by metric

edschembor
Path Finder

Nvm, solved it with:

index=hpov eph " error " AND (tag="EPH_SVR") | eval ReasonForFailure="" | chart count as error by ReasonForFailure | appendcols [ search index=hpov eph " fatal " AND (tag="EPH_SVR") | stats count as fatal]

0 Karma

edschembor
Path Finder

But what about the second part? When I switch to a larger search:

index=hpov eph " error " AND (tag="EPH_SVR") | eval errCount="Errors" | chart count by errCount | appendcols [search index=hpov eph " exception " AND (tag="EPH_SVR")| stats count as exception]| appendcols [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") | stats count as exception]

Then the x-axis is errCount and when I hover over a bar i get "errCount: Errors"

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...