Dashboards & Visualizations

How to include another field into the visual

kelie
Path Finder

I'm working with dashboards and the goal is to show a bar graph panel that displays the counts for two different fields separately
(2 bars per timespan) if possible.
The data is from the same index...the actions field(action=blocked) and category field (category=221)

I can build a visual for each individual field but having trouble combining the two.

index=url_filter action=blocked login_id="$user$"|stats count by _time |bucket _time span=1h 

I have another field not exclusive to field [action=blocked] that id like to display as well.
Any tips appreciated.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| bucket _time span=1h
| stats count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221 BY _time

OR

index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| timechart span=1h count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221

View solution in original post

kelie
Path Finder

sorry for leaving it out but a sample search for category would have been

index=url_filter category=221 login_id="$user$"|stats count by _time |bucket _time span=1h

these answers have definitely put me on the right track with the eval

0 Karma

woodcock
Esteemed Legend

Do the bucket earlier. See my answer.

somesoni2
Revered Legend

Try like this (assuming calculation of count independently for both conditions). You didn't provide a query for calculation of category=221, I'm just using filter based on field category, adjust the query per yours)

index=url_filter (action=blocked login_id="$user$") OR (category=221)
| eval CountBlocked=if(action="blocked",1,0) , CountCat221=if(category=221,1,0)
| timechart span=1h sum(CountBlocked) as CountBlocked sum(CountCat221) as CountCat221

woodcock
Esteemed Legend

Like this:

index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| bucket _time span=1h
| stats count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221 BY _time

OR

index="url_filter" AND login_id="$user$" AND (action="blocked" OR category="221")
| timechart span=1h count(eval(action="blocked")) AS blocked count(eval(category="221")) AS count221

kelie
Path Finder

this solution worked and is simplified, than you both for the answers

0 Karma

woodcock
Esteemed Legend

Be sure to come back here and click Accept to close the question and also UpVote any answers or comments that were useful.

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...