Dashboards & Visualizations

Splunk Charting Data Based on Type

naralkar
Engager

I have derived data from Splunk in the following format (Actual Format). But I want to format furthermore it in such a way that I can see which items are present in which categories, and which are missing (Expected Format). I am trying to chart it based on categoryID, but it's not working for me as I do not think max function is appropriate for this. Can anyone please help me know how can I achieve this

Tried using

| chart max(itemId) over itemId by categoryID

Expected Format

Expected FormatExpected Format

Actual Format 

Actual DataActual Data

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults count=30
| eval categoryID=mvindex(split("Strategy,Archade",","),random() % 2)
| eval itemId="EST-1".(random() % 9 + 1)
| rex "(?<Comment>(?# this is your actual result, check this. 
from here, the logic))"
| xyseries itemId categoryID itemId

View solution in original post

to4kawa
Ultra Champion
| makeresults count=30
| eval categoryID=mvindex(split("Strategy,Archade",","),random() % 2)
| eval itemId="EST-1".(random() % 9 + 1)
| rex "(?<Comment>(?# this is your actual result, check this. 
from here, the logic))"
| xyseries itemId categoryID itemId

naralkar
Engager

Thanks @to4kawa . This was all I needed.. 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...