Hi All,
<|script python afiStatistics afiStats >
Above query Result is following output:
Type Count
Allowed 11
Blocked 12
With the above query i want create Bar chart, But it is not able to draw the chart
Expected output
|
Type|--------------------------------------------
|--------------------------
|
Count
advance Thanks,
Just add | table Type Count
to change the order of the fields; here is a run-anywhere example:
| makeresults
| eval raw="Type=Allowed,Count=11 Type=Blocked,Count=12"
| makemv raw
| mvexpand raw
| rename raw As _raw
| kv
| fields - _*
| table Type Count
Hey Uppukumar!
Let me know if this works for you:
...BASE SEARCH...
| table Type Count
| chart values(Count) AS Count by Type
| sort - Count
Make sure the "Bar Chart" is selected as your visualization type, and your data should display the way you described.
Since the count is already aggregated in your data, the values
function should work for you.
If you would prefer aggregate your data or chart it in a different way, refer to the "Stats function options" section of the Splunk chart documentation.
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Chart
Let me know if you have any problems!