Getting Data In

How to chart counts of events as Y axis, time as X axis and legend as field values?

splunk_new1
Explorer

Hi! I'm new to using splunk and I am currently trying to chart a series of events over a time period. I have managed to use the rex command and extracted out the values of interest to me. 

Right now I would like to make it such that each individual "power" values are appearing as a line on its own with it's own legend, similar to how timechart would look like. How can I do that? 

Screenshot 2020-10-14 040743.png

Screenshot 2020-10-14 040332.png

Also, I have another 5 events together in this index which are not the same format as the other logs in this index, is it possible for me to also use rex to extract them into another field and finally COMBINE both extracted REX fields into one big happy timechart/chart? 

 

 

expectedexpected
something like this ^


I appreciate your time and thanks in advance for the help! 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by _time power

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| stats count by _time power

splunk_new1
Explorer

Great! This solved my issue and helped me further with my splunk searches! Thanks so much! Sorry for the late reply.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...