Dashboards & Visualizations

How to compare the count of two fields from different source types ?

Ombessam
Path Finder

How can I get the following visualization ?

Field1VsField2.png

I've tried the following commands:

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2")
| fields field1 field2
| stats count(field1) as Field1, count(field2) as Field2

and I getting the following graph

Screenshot 2025-04-01 at 19.00.30.png

Labels (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @Ombessam ,

To get the desired visualisation comparing the counts of field1 and field2, you need to transform the results of your stats command so that the field names become values in one column and the counts become values in another. The transpose command is suitable for this.

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2")
| stats count(field1) as Field1, count(field2) as Field2
| transpose
| rename column as FieldName, "row 1" as Count

 

This structure (FieldName, Count) allows you to configure your bar chart visualization.

livehybrid_0-1743537129332.png

 

You could also achieve this with:

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2")
| eval x="x" 
| stats count(status) as field1, count(bytes) as field2 by x

livehybrid_1-1743537175169.png

 

🌟 Did this answer help you? If so, please consider:

  • Adding kudos to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

Ombessam
Path Finder

Awesome @livehybrid , Thanks

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @Ombessam ,

To get the desired visualisation comparing the counts of field1 and field2, you need to transform the results of your stats command so that the field names become values in one column and the counts become values in another. The transpose command is suitable for this.

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2")
| stats count(field1) as Field1, count(field2) as Field2
| transpose
| rename column as FieldName, "row 1" as Count

 

This structure (FieldName, Count) allows you to configure your bar chart visualization.

livehybrid_0-1743537129332.png

 

You could also achieve this with:

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2")
| eval x="x" 
| stats count(status) as field1, count(bytes) as field2 by x

livehybrid_1-1743537175169.png

 

🌟 Did this answer help you? If so, please consider:

  • Adding kudos to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...