Knowledge Management

How to question mark fields

harishyhrk
New Member

How to mark the fields with a question.

Tags (1)
0 Karma

niketn
Legend

@harishyhrk, I am not sure if this was intentional, seems like you have wiped off your question with a new one but with only partial information. Requesting you to retain your original question here since answers have been provided with respect to the same. If the issue has been resolved, requesting you to accept the same as well.

Also, for a question on different lines, requesting you to post a new question.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@harishyhrk, if your current query is giving your Total_Time, Average and Minimum Columns for two Environments and you need it to be inversed, you should use the transpose command as the final pipe in your current query i.e.

  <YourCurrentSearch>
  | transpose header_field="Environment" column_name="Environment"

Following is a run anywhere search based on Splunk's _internal index. (PS: All data/stats is cooked up to generate some chart as per what you currently have).

alt text

index=_internal sourcetype=splunkd component!="ConfContentsCache" (log_level="WARN" OR log_level="ERROR")
| stats sum(date_second) as Total_Time avg(date_second) as Average min(date_second) as Minimum by log_level
| replace "ERROR" with "OpenShift" in log_level
| replace "WARN" with "Onpremises" in log_level
| rename log_level as Environment
| transpose header_field=Environment column_name=Environment
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Actually I wanted to say non-stacked option (sorry about that). I create a runanywhere search to generate sample data as yours and use basic column chart for visualization and got this. Does it match what you need?

Search:

| gentimes start=-1 | eval temp="openpremisis#10.1111#8.2222#2.33333 openshift#12.4444#8.55555#2.66666" | table temp  | makemv temp | mvexpand temp | rename temp as _raw | rex "(?<Environment>.+)#(?<Total>.+)#(?<Average>.+)#(?<Minimum>.+)"  | table Environment Total Average Minimum

Output chart:

alt text

0 Karma

somesoni2
Revered Legend

Try with column chart with stacked option (no Trellies)

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...