splunk visualization

[chookp]

hi i had made a stats table base on below command

and under my visualization is :

i would like to ask if there is a way to have additional information at the X-axis example the current X axis have the DESCRIPTION and count(VALUE), but i would like to have the VALUE (RUN and STOP) information inside too

[chookp]

i am sorry but i have no idea how i can fix my query into the query that you have given, i am thinking of if i am able to click on the bar and it will show my VALUE base on the DESCRIPTION on top, but different ASSET_NAME have different number of DESCRIPTION and the VALUE are also different . base on the query you given you have fix the result to show as 4 and the count value as 24 i suppose?

[to4kawa]

Have you try my query and see the result?

I created the query from your result.

I don't know what you do not understand it.

Please see the reference and try line by line.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults

[to4kawa]

| makeresults count=4
| streamstats count 
| fillnull DESCRIPTION VALUE ASSET_NAME 
| eval DESCRIPTION="STN DR SUMP Pump ".ceil(count/2)." Run/Stop Status Ante RM 1"
| eval VALUE=mvindex(split("RUN/STOP","/"),(count % 2)-1)
| eval ASSET_NAME="XPO/CIV/DES/DSS11"
| eval "count(VALUE)" = 24 - ceil(count/2)
| table DESCRIPTION VALUE ASSET_NAME count(VALUE)
| rename COMMENT as "this is sample you provide. from here, the logic"

| eval ASSET_NAME=ASSET_NAME.":".VALUE 
| xyseries DESCRIPTION ASSET_NAME count(VALUE)

try Visualization >> Column Chart stacked

[chookp]

hi thanks for the help i am able to get the visualization, but this is on a fix ASSET_NAME if i have my ASSET_NAME with a lot of variables is there a way to use REX to do it?

[to4kawa]

"this is sample you provide. from here, the logic"
try logic to your query.