Dashboards & Visualizations

How to chart a table by two parameters

huiminluo
Observer

Hi there, 

I have s splunk search command as follows, it have [year_month, service_label, condition, value]

|inputlookup druid_availability_lookup.csv
|stats sum(good_events) as good_events, sum(total) as total by year_month
|eval service_label = "Druid Data Service-availablity", value=round((good_events/total)*100, 2), condition= if(value<=100, "Fail","")
|table year_month, service_label, condition, value

 
 
 
 
 
 

huiminluo_0-1609920305060.png

And i want to displays this result by year_month, when i append commans [|chart values(value) over service_label by year_month] , it will displays as follows, the condition column will be losed. 

 

1.6.PNG

Is there any methods that can display the result by  year_month and also include the condition parameters, thanks

 
 
 

 

 
 

 

 

Labels (1)
0 Karma

ericjorgensenjr
Path Finder

Another option if you don't plan on turning this into a graph and will only be using the chart itself:

 

| eval service_label = "Druid Data Service-availability", value=round((good_events/total)*100,2), condition=if(value<=100,"Fail",""),value=if(condition="",value,value." (".condition.")")
0 Karma

saravanan90
Contributor

Please check if the below query helps. 

| makeresults
| eval _raw="year_month service_label condition value
2020-10 Drudit fail 100.0
2020-11 Drudit fail 100.0
2020-12 Drudit fail 100.0"
| multikv forceheader=1
| table year_month condition service_label value
| transpose header_field=year_month
| rename column as temp

-----------------------------------------------------------

An upvote would be appreciated if the above reply is useful to you.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...