All Apps and Add-ons
Highlighted

Basic Chart Issue

Path Finder

So, I'm probably blanking on something, but I'm just trying to create a bar chart for a single value. So:

index=hpov eph " error " AND (tag="EPH_SVR") | chart count

But for some reason the bar graph won't appear. The reason I'm doing this is that I then have a larger search which appends columns, and for some reason, the first value (error count) won't appear as a bar and instead appears as the x-axis.

Thanks for the help!

0 Karma
Highlighted

Re: Basic Chart Issue

SplunkTrust
SplunkTrust

For plotting a chart your need 2 columns for both x an y axis. You search is producing just one.

Try something like this

index=hpov eph " error " AND (tag="EPH_SVR") | eval metric="Errors" | chart count by metric

View solution in original post

Highlighted

Re: Basic Chart Issue

Path Finder

But what about the second part? When I switch to a larger search:

index=hpov eph " error " AND (tag="EPHSVR") | eval errCount="Errors" | chart count by errCount | appendcols [search index=hpov eph " exception " AND (tag="EPHSVR")| stats count as exception]| appendcols [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") | stats count as exception]

Then the x-axis is errCount and when I hover over a bar i get "errCount: Errors"

0 Karma
Highlighted

Re: Basic Chart Issue

Path Finder

Nvm, solved it with:

index=hpov eph " error " AND (tag="EPHSVR") | eval ReasonForFailure="" | chart count as error by ReasonForFailure | appendcols [ search index=hpov eph " fatal " AND (tag="EPHSVR") | stats count as fatal]

0 Karma