Dashboards & Visualizations

Splunk Charting Data Based on Type

naralkar
Engager

I have derived data from Splunk in the following format (Actual Format). But I want to format furthermore it in such a way that I can see which items are present in which categories, and which are missing (Expected Format). I am trying to chart it based on categoryID, but it's not working for me as I do not think max function is appropriate for this. Can anyone please help me know how can I achieve this

Tried using

| chart max(itemId) over itemId by categoryID

Expected Format

Expected FormatExpected Format

Actual Format 

Actual DataActual Data

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults count=30
| eval categoryID=mvindex(split("Strategy,Archade",","),random() % 2)
| eval itemId="EST-1".(random() % 9 + 1)
| rex "(?<Comment>(?# this is your actual result, check this. 
from here, the logic))"
| xyseries itemId categoryID itemId

View solution in original post

to4kawa
Ultra Champion
| makeresults count=30
| eval categoryID=mvindex(split("Strategy,Archade",","),random() % 2)
| eval itemId="EST-1".(random() % 9 + 1)
| rex "(?<Comment>(?# this is your actual result, check this. 
from here, the logic))"
| xyseries itemId categoryID itemId

naralkar
Engager

Thanks @to4kawa . This was all I needed.. 

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...