Dashboards & Visualizations

How to chart a table by two parameters

huiminluo
Observer

Hi there, 

I have s splunk search command as follows, it have [year_month, service_label, condition, value]

|inputlookup druid_availability_lookup.csv
|stats sum(good_events) as good_events, sum(total) as total by year_month
|eval service_label = "Druid Data Service-availablity", value=round((good_events/total)*100, 2), condition= if(value<=100, "Fail","")
|table year_month, service_label, condition, value

 
 
 
 
 
 

huiminluo_0-1609920305060.png

And i want to displays this result by year_month, when i append commans [|chart values(value) over service_label by year_month] , it will displays as follows, the condition column will be losed. 

 

1.6.PNG

Is there any methods that can display the result by  year_month and also include the condition parameters, thanks

 
 
 

 

 
 

 

 

Labels (1)
0 Karma

ericjorgensenjr
Path Finder

Another option if you don't plan on turning this into a graph and will only be using the chart itself:

 

| eval service_label = "Druid Data Service-availability", value=round((good_events/total)*100,2), condition=if(value<=100,"Fail",""),value=if(condition="",value,value." (".condition.")")
0 Karma

saravanan90
Contributor

Please check if the below query helps. 

| makeresults
| eval _raw="year_month service_label condition value
2020-10 Drudit fail 100.0
2020-11 Drudit fail 100.0
2020-12 Drudit fail 100.0"
| multikv forceheader=1
| table year_month condition service_label value
| transpose header_field=year_month
| rename column as temp

-----------------------------------------------------------

An upvote would be appreciated if the above reply is useful to you.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...