Dashboards & Visualizations

Hw to create Multiple group by in a splunk chart (Object types and names monitoring)?

amaralt808
Path Finder

Hello Splunk Family,

I am looking for help on making a graph in Splunk.

I am trying to monitor the amount of transactions by different methods names with different objects and separate that by date.

Here is an example of the data I have

Date Object Type Object Name Total Transactions
Aug 1 LibPush Root 15
Aug 1 LibPush ProcessQueue 12
Aug 1 LibPush Failed 2
Aug 1 Company ChangeConfigSet 34
Aug 1 Company CleanUpMsg 15
Aug 1 Company GetMsg 32
Aug 1 Company SendMSG 13
Aug 2 LibPush Root 15
Aug 2 LibPush ProcessQueue 12
Aug 2 LibPush Failed 2
Aug 2 Company ChangeConfigSet 34
Aug 2 Company CleanUpMsg 15
Aug 2 Company GetMsg 32
Aug 2 Company SendMSG 45
Aug 3 LibPush Root 15
Aug 3 LibPush ProcessQueue 12
Aug 3 LibPush Failed 2
Aug 3 Company ChangeConfigSet 34
Aug 3 Company CleanUpMsg 15
Aug 3 Company GetMsg 32
Aug 3 Company SendMSG 45

 

The only thing is that there are a lot of Object Types and Object Names so maybe the top 10 object types per day.

Here is a lame attempt at a drawing of what I want.

Here is the code I got so far

[mycode] | bin _time span=1d| chart count(indexid) over actionelementname by actionelementtype

but it is missing the date and it is not stacked.

 

Any help would be deeply appreciated! 

 

 

Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can do

... search...
| eval c=actionelementtype.":".actionelementname
| chart sum(Total_Transactions) over _time by c

and then you will get it over time and you can stack it with the chart format options.

or how did you imaging visualising these two dimensions over _time?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...