Dashboards & Visualizations

Splunk Charting Data Based on Type

naralkar
Engager

I have derived data from Splunk in the following format (Actual Format). But I want to format furthermore it in such a way that I can see which items are present in which categories, and which are missing (Expected Format). I am trying to chart it based on categoryID, but it's not working for me as I do not think max function is appropriate for this. Can anyone please help me know how can I achieve this

Tried using

| chart max(itemId) over itemId by categoryID

Expected Format

Expected FormatExpected Format

Actual Format 

Actual DataActual Data

Labels (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults count=30
| eval categoryID=mvindex(split("Strategy,Archade",","),random() % 2)
| eval itemId="EST-1".(random() % 9 + 1)
| rex "(?<Comment>(?# this is your actual result, check this. 
from here, the logic))"
| xyseries itemId categoryID itemId

View solution in original post

to4kawa
Ultra Champion
| makeresults count=30
| eval categoryID=mvindex(split("Strategy,Archade",","),random() % 2)
| eval itemId="EST-1".(random() % 9 + 1)
| rex "(?<Comment>(?# this is your actual result, check this. 
from here, the logic))"
| xyseries itemId categoryID itemId

naralkar
Engager

Thanks @to4kawa . This was all I needed.. 

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...