Dashboards & Visualizations

How to chart a table by two parameters

huiminluo
Observer

Hi there, 

I have s splunk search command as follows, it have [year_month, service_label, condition, value]

|inputlookup druid_availability_lookup.csv
|stats sum(good_events) as good_events, sum(total) as total by year_month
|eval service_label = "Druid Data Service-availablity", value=round((good_events/total)*100, 2), condition= if(value<=100, "Fail","")
|table year_month, service_label, condition, value

 
 
 
 
 
 

huiminluo_0-1609920305060.png

And i want to displays this result by year_month, when i append commans [|chart values(value) over service_label by year_month] , it will displays as follows, the condition column will be losed. 

 

1.6.PNG

Is there any methods that can display the result by  year_month and also include the condition parameters, thanks

 
 
 

 

 
 

 

 

Labels (1)
0 Karma

ericjorgensenjr
Path Finder

Another option if you don't plan on turning this into a graph and will only be using the chart itself:

 

| eval service_label = "Druid Data Service-availability", value=round((good_events/total)*100,2), condition=if(value<=100,"Fail",""),value=if(condition="",value,value." (".condition.")")
0 Karma

saravanan90
Contributor

Please check if the below query helps. 

| makeresults
| eval _raw="year_month service_label condition value
2020-10 Drudit fail 100.0
2020-11 Drudit fail 100.0
2020-12 Drudit fail 100.0"
| multikv forceheader=1
| table year_month condition service_label value
| transpose header_field=year_month
| rename column as temp

-----------------------------------------------------------

An upvote would be appreciated if the above reply is useful to you.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...