All Apps and Add-ons

Basic Chart Issue

edschembor
Path Finder

So, I'm probably blanking on something, but I'm just trying to create a bar chart for a single value. So:

index=hpov eph " error " AND (tag="EPH_SVR") | chart count

But for some reason the bar graph won't appear. The reason I'm doing this is that I then have a larger search which appends columns, and for some reason, the first value (error count) won't appear as a bar and instead appears as the x-axis.

Thanks for the help!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

For plotting a chart your need 2 columns for both x an y axis. You search is producing just one.

Try something like this

index=hpov eph " error " AND (tag="EPH_SVR") | eval metric="Errors" | chart count by metric

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

For plotting a chart your need 2 columns for both x an y axis. You search is producing just one.

Try something like this

index=hpov eph " error " AND (tag="EPH_SVR") | eval metric="Errors" | chart count by metric

edschembor
Path Finder

Nvm, solved it with:

index=hpov eph " error " AND (tag="EPH_SVR") | eval ReasonForFailure="" | chart count as error by ReasonForFailure | appendcols [ search index=hpov eph " fatal " AND (tag="EPH_SVR") | stats count as fatal]

0 Karma

edschembor
Path Finder

But what about the second part? When I switch to a larger search:

index=hpov eph " error " AND (tag="EPH_SVR") | eval errCount="Errors" | chart count by errCount | appendcols [search index=hpov eph " exception " AND (tag="EPH_SVR")| stats count as exception]| appendcols [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") | stats count as exception]

Then the x-axis is errCount and when I hover over a bar i get "errCount: Errors"

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...