Dashboards & Visualizations

How to chart with 2 different data over a time period?

angersleek
Path Finder
index=my-index ns=my-namespace app_name=my-api DECISION IN (YES, NO) | chart list(DECISION) BY PRODUCT_ID

For above query, how could I possibly chart it for a query of 90 days. I want the data to be shown weekly. There are 11 possible ids for the value PRODUCT_ID.

Thus total 3 things to consider. PRODUCT_ID (11 types), DECISION (2 types) and the timeline to be shown weekly for a 90 day period.
How can I chart this in Splunk? Bit confused as to what chart would fit this scenario and how to write the query to chart this. Appreciate any advice. Thanks.

Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=my-index ns=my-namespace app_name=my-api DECISION IN (YES, NO)

| fields _time DECISION PRODUCT_ID
| bin span=1d _time
| stats  values(PRODUCT_ID) as PRODUCT_ID by _time DECISION

as you like.

View solution in original post

to4kawa
Ultra Champion
index=my-index ns=my-namespace app_name=my-api DECISION IN (YES, NO)

| fields _time DECISION PRODUCT_ID
| bin span=1d _time
| stats  values(PRODUCT_ID) as PRODUCT_ID by _time DECISION

as you like.

skoelpin
SplunkTrust
SplunkTrust

Try this

index=my-index ns=my-namespace app_name=my-api DECISION IN (YES, NO) earliest=-90d@d latest=now
| timechart values(DECISION) BY PRODUCT_ID
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...