Dashboards & Visualizations

Hw to create Multiple group by in a splunk chart (Object types and names monitoring)?

amaralt808
Path Finder

Hello Splunk Family,

I am looking for help on making a graph in Splunk.

I am trying to monitor the amount of transactions by different methods names with different objects and separate that by date.

Here is an example of the data I have

Date Object Type Object Name Total Transactions
Aug 1 LibPush Root 15
Aug 1 LibPush ProcessQueue 12
Aug 1 LibPush Failed 2
Aug 1 Company ChangeConfigSet 34
Aug 1 Company CleanUpMsg 15
Aug 1 Company GetMsg 32
Aug 1 Company SendMSG 13
Aug 2 LibPush Root 15
Aug 2 LibPush ProcessQueue 12
Aug 2 LibPush Failed 2
Aug 2 Company ChangeConfigSet 34
Aug 2 Company CleanUpMsg 15
Aug 2 Company GetMsg 32
Aug 2 Company SendMSG 45
Aug 3 LibPush Root 15
Aug 3 LibPush ProcessQueue 12
Aug 3 LibPush Failed 2
Aug 3 Company ChangeConfigSet 34
Aug 3 Company CleanUpMsg 15
Aug 3 Company GetMsg 32
Aug 3 Company SendMSG 45

 

The only thing is that there are a lot of Object Types and Object Names so maybe the top 10 object types per day.

Here is a lame attempt at a drawing of what I want.

Here is the code I got so far

[mycode] | bin _time span=1d| chart count(indexid) over actionelementname by actionelementtype

but it is missing the date and it is not stacked.

 

Any help would be deeply appreciated! 

 

 

Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can do

... search...
| eval c=actionelementtype.":".actionelementname
| chart sum(Total_Transactions) over _time by c

and then you will get it over time and you can stack it with the chart format options.

or how did you imaging visualising these two dimensions over _time?

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...