Knowledge Management

How to question mark fields

harishyhrk
New Member

How to mark the fields with a question.

Tags (1)
0 Karma

niketn
Legend

@harishyhrk, I am not sure if this was intentional, seems like you have wiped off your question with a new one but with only partial information. Requesting you to retain your original question here since answers have been provided with respect to the same. If the issue has been resolved, requesting you to accept the same as well.

Also, for a question on different lines, requesting you to post a new question.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@harishyhrk, if your current query is giving your Total_Time, Average and Minimum Columns for two Environments and you need it to be inversed, you should use the transpose command as the final pipe in your current query i.e.

  <YourCurrentSearch>
  | transpose header_field="Environment" column_name="Environment"

Following is a run anywhere search based on Splunk's _internal index. (PS: All data/stats is cooked up to generate some chart as per what you currently have).

alt text

index=_internal sourcetype=splunkd component!="ConfContentsCache" (log_level="WARN" OR log_level="ERROR")
| stats sum(date_second) as Total_Time avg(date_second) as Average min(date_second) as Minimum by log_level
| replace "ERROR" with "OpenShift" in log_level
| replace "WARN" with "Onpremises" in log_level
| rename log_level as Environment
| transpose header_field=Environment column_name=Environment
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Actually I wanted to say non-stacked option (sorry about that). I create a runanywhere search to generate sample data as yours and use basic column chart for visualization and got this. Does it match what you need?

Search:

| gentimes start=-1 | eval temp="openpremisis#10.1111#8.2222#2.33333 openshift#12.4444#8.55555#2.66666" | table temp  | makemv temp | mvexpand temp | rename temp as _raw | rex "(?<Environment>.+)#(?<Total>.+)#(?<Average>.+)#(?<Minimum>.+)"  | table Environment Total Average Minimum

Output chart:

alt text

0 Karma

somesoni2
Revered Legend

Try with column chart with stacked option (no Trellies)

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...