Getting Data In

turn a columns with multiple entries into a chart

rite10privacy10
Explorer

Hello,

I am pretty new to splunk, and just feel lost at times. I have a question that i cant seem to find an answer for. 
I have data that looks like 

rite10privacy10_0-1628861075129.png

so the above is like 1 row and then there are multiple  rows with the same type of list of entries for timestamp and total

now I want to turn each row into a line on a line chart where the x-axis is the timestamp and the y-axis is the "Total". sort of like overlapping line charts based on all the rows.

anyone have ideas 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval zipped=mvzip(TimeStamp,Total,"!")
| mvexpand zipped
| eval TimeStamp=mvindex(split(zipped,"!"),0)
| eval Total=mvindex(split(zipped,"!"),1)
| fields - zipped

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval zipped=mvzip(TimeStamp,Total,"!")
| mvexpand zipped
| eval TimeStamp=mvindex(split(zipped,"!"),0)
| eval Total=mvindex(split(zipped,"!"),1)
| fields - zipped

rite10privacy10
Explorer

you are a beautiful soul

0 Karma

Spranta
Splunk Employee
Splunk Employee

Great solution, just noticed that my solution has the issues that I'm dedupping the same results so this will lead to an incorrect total value

0 Karma

rite10privacy10
Explorer

Hello, So i have tried that the issue is tho and then i get a table that looks like this 

rite10privacy10_0-1628863408501.png


so then i apply same thing to the Total columns and i get a bunch of duplicate rows, is there a way to delete all duplicate rows at that point?

0 Karma

Spranta
Splunk Employee
Splunk Employee

Hi, have you tried to expand the Multiple Value field with

| mvexand TimeStamp?

0 Karma

rite10privacy10
Explorer

Hello, So i have tried that the issue is tho and then i get a table that looks like this 

rite10privacy10_0-1628864550808.png

 


so then i apply same thing to the Total columns and i get a bunch of duplicate rows, is there a way to delete all duplicate rows at that point?

0 Karma

Spranta
Splunk Employee
Splunk Employee

yes, try

| dedup TimeStamp,Total

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...