Dashboards & Visualizations

Hw to create Multiple group by in a splunk chart (Object types and names monitoring)?

amaralt808
Path Finder

Hello Splunk Family,

I am looking for help on making a graph in Splunk.

I am trying to monitor the amount of transactions by different methods names with different objects and separate that by date.

Here is an example of the data I have

Date Object Type Object Name Total Transactions
Aug 1 LibPush Root 15
Aug 1 LibPush ProcessQueue 12
Aug 1 LibPush Failed 2
Aug 1 Company ChangeConfigSet 34
Aug 1 Company CleanUpMsg 15
Aug 1 Company GetMsg 32
Aug 1 Company SendMSG 13
Aug 2 LibPush Root 15
Aug 2 LibPush ProcessQueue 12
Aug 2 LibPush Failed 2
Aug 2 Company ChangeConfigSet 34
Aug 2 Company CleanUpMsg 15
Aug 2 Company GetMsg 32
Aug 2 Company SendMSG 45
Aug 3 LibPush Root 15
Aug 3 LibPush ProcessQueue 12
Aug 3 LibPush Failed 2
Aug 3 Company ChangeConfigSet 34
Aug 3 Company CleanUpMsg 15
Aug 3 Company GetMsg 32
Aug 3 Company SendMSG 45

 

The only thing is that there are a lot of Object Types and Object Names so maybe the top 10 object types per day.

Here is a lame attempt at a drawing of what I want.

Here is the code I got so far

[mycode] | bin _time span=1d| chart count(indexid) over actionelementname by actionelementtype

but it is missing the date and it is not stacked.

 

Any help would be deeply appreciated! 

 

 

Labels (5)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can do

... search...
| eval c=actionelementtype.":".actionelementname
| chart sum(Total_Transactions) over _time by c

and then you will get it over time and you can stack it with the chart format options.

or how did you imaging visualising these two dimensions over _time?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...