Dashboards & Visualizations

Can we plot string values in a graph?

SumeetSirohi
New Member

I have three columns in stats.
1. Date
2. Number
3. String Value (ABCDEF)

Once i create a chart over "Date " , how can I also show the corresponding "string value" in the graph?

Since line\Area graph will only consider numerical values, it doesn't show the 3rd field values.

I am expecting to have Date in X axis and Number in Y Axis. Can anyone help?

Tags (2)
0 Karma
1 Solution

Sukisen1981
Champion

Perhaps you are looking or xyseries.
I ran a query on the default _audit index so that you can use the code to run as it is. Try the below:
index="_audit" | stats count by _time,action
The above code gives you _time,action and count as columns in the statistics output.
Now, try this :
index="_audit" | stats count by _time,action | xyseries _time,action,count

See the visualization tab, this is perhaps what you want. Replace your fields to map accordingly, basically the below, if the above result is what you want-
Date - _time
Number - count
action - string

View solution in original post

0 Karma

Sukisen1981
Champion

Perhaps you are looking or xyseries.
I ran a query on the default _audit index so that you can use the code to run as it is. Try the below:
index="_audit" | stats count by _time,action
The above code gives you _time,action and count as columns in the statistics output.
Now, try this :
index="_audit" | stats count by _time,action | xyseries _time,action,count

See the visualization tab, this is perhaps what you want. Replace your fields to map accordingly, basically the below, if the above result is what you want-
Date - _time
Number - count
action - string

0 Karma

SumeetSirohi
New Member

This is exactly what i was looking for. Thank you so much!!

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and stall ...

Print, Leak, Repeat: UEBA Insider Threats You Can't Ignore

Are you ready to uncover the threats hiding in plain sight? Join us for "Print, Leak, Repeat: UEBA Insider ...

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...