Dashboards & Visualizations

Not able to draw bar chart

uppukumar
Explorer

Hi All,

<|script python afiStatistics afiStats >
Above query Result is following output:

Type Count
Allowed 11
Blocked 12

With the above query i want create Bar chart, But it is not able to draw the chart

Expected output
|
Type|--------------------------------------------
|--------------------------
|
Count

advance Thanks,

0 Karma

woodcock
Esteemed Legend

Just add | table Type Count to change the order of the fields; here is a run-anywhere example:

| makeresults 
| eval raw="Type=Allowed,Count=11 Type=Blocked,Count=12" 
| makemv raw 
| mvexpand raw 
| rename raw As _raw 
| kv
| fields - _*
| table Type Count
0 Karma

rbechtold
Communicator

Hey Uppukumar!

Let me know if this works for you:

...BASE SEARCH...
| table Type Count 
| chart values(Count) AS Count by Type 
| sort - Count

Make sure the "Bar Chart" is selected as your visualization type, and your data should display the way you described.

Since the count is already aggregated in your data, the values function should work for you.

If you would prefer aggregate your data or chart it in a different way, refer to the "Stats function options" section of the Splunk chart documentation.

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Chart

Let me know if you have any problems!

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...