Getting Data In

turn a columns with multiple entries into a chart

rite10privacy10
Explorer

Hello,

I am pretty new to splunk, and just feel lost at times. I have a question that i cant seem to find an answer for. 
I have data that looks like 

rite10privacy10_0-1628861075129.png

so the above is like 1 row and then there are multiple  rows with the same type of list of entries for timestamp and total

now I want to turn each row into a line on a line chart where the x-axis is the timestamp and the y-axis is the "Total". sort of like overlapping line charts based on all the rows.

anyone have ideas 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval zipped=mvzip(TimeStamp,Total,"!")
| mvexpand zipped
| eval TimeStamp=mvindex(split(zipped,"!"),0)
| eval Total=mvindex(split(zipped,"!"),1)
| fields - zipped

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval zipped=mvzip(TimeStamp,Total,"!")
| mvexpand zipped
| eval TimeStamp=mvindex(split(zipped,"!"),0)
| eval Total=mvindex(split(zipped,"!"),1)
| fields - zipped

rite10privacy10
Explorer

you are a beautiful soul

0 Karma

Spranta
Splunk Employee
Splunk Employee

Great solution, just noticed that my solution has the issues that I'm dedupping the same results so this will lead to an incorrect total value

0 Karma

rite10privacy10
Explorer

Hello, So i have tried that the issue is tho and then i get a table that looks like this 

rite10privacy10_0-1628863408501.png


so then i apply same thing to the Total columns and i get a bunch of duplicate rows, is there a way to delete all duplicate rows at that point?

0 Karma

Spranta
Splunk Employee
Splunk Employee

Hi, have you tried to expand the Multiple Value field with

| mvexand TimeStamp?

0 Karma

rite10privacy10
Explorer

Hello, So i have tried that the issue is tho and then i get a table that looks like this 

rite10privacy10_0-1628864550808.png

 


so then i apply same thing to the Total columns and i get a bunch of duplicate rows, is there a way to delete all duplicate rows at that point?

0 Karma

Spranta
Splunk Employee
Splunk Employee

yes, try

| dedup TimeStamp,Total

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...