Is it possible to create a line chart using table columns and also see in tooltip?

[ajayrathore]

I have a table with four columns - time, duration, clientip, query.

Duration is a numeric field and I can plot a line chart using first two columns, however I also want to see the corresponding last two columns in the tooltip, is this possible?

[gcusello]

Hi

let me understand: you have a lookup containing many rows with one column, called e.g. source, with one value and another column with many values divided e.g. by comma that are destinations and you want to match (whitelist) each source and each destination in your main search, is this correct?

if this is your need and the field names are the same in main search and lookup (src, dest), you could use something like this:

<your_search> [ | inputlookup your_lookup.csv | eval dest=split(dest,",") | fields src dest ] | ...

for more infos about multivalue treatment, see at https://docs.splunk.com/Documentation/Splunk/9.0.2/SearchReference/MultivalueEvalFunctions

Ciao.

Giuseppe

[ajayrathore]

Hi

You understood it incorrectly, there is no source or dest columns

My search query yields a table with four columns which I am trying to plot as described above. I just want all of the columns to appear in the tooltip when users hoover over the line chart points.