Adding Column to charts based on lookup table

[aquinojason]

Hi,

How am I able to add the BusinessUnit Column on my splunk query below?  The output 

index=xxxxxxx sourcetype=xxxxxxx | multikv forceheader=1 | dedup ACCOUNT_CODE DATE MVS_SYSTEM_ID CALCMIPS | eval DATE=strftime(strptime(DATE,"%d%b%y"),"%Y-%m-%d") | lookup Account_file.csv ACCOUNT_CODE OUTPUT Application BusinessUnit ApplicationRTO | eval _time=strptime(DATE." "."00:00:00","%Y-%m-%d %H:%M:%S") | table _time Application BusinessUnit MVS_SYSTEM_ID CALCMIPS | chart avg(CALCMIPS) by Application DATE limit=0

Output should look like something below with BusinessUnit after Application.

Thanks and Regards,

[ITWhisperer]

Chart doesn't pass the column, in fact, it creates a table with two dimensions (Application and DATE in your instance), and one value (your average) for each cell. If you want the BusinessUnit passed through, you need to add it to the x dimension (Application) before the chart command

index=xxxxxxx sourcetype=xxxxxxx | multikv forceheader=1 | dedup ACCOUNT_CODE DATE MVS_SYSTEM_ID CALCMIPS | eval DATE=strftime(strptime(DATE,"%d%b%y"),"%Y-%m-%d") | lookup Account_file.csv ACCOUNT_CODE OUTPUT Application BusinessUnit ApplicationRTO | eval _time=strptime(DATE." "."00:00:00","%Y-%m-%d %H:%M:%S") | table _time Application BusinessUnit MVS_SYSTEM_ID CALCMIPS 
| eval Application=Application." - ".BusinessUnit
| chart avg(CALCMIPS) by Application DATE limit=0

[aquinojason]

Hi,

Thank you for the quick response. Can I use a different function to achieve it? I was hoping I can sort it by Application or by Business Unit.

Thanks and Regards,

[ITWhisperer]

You could split the field after the chart so long as you are not going to then try to visualise it

index=xxxxxxx sourcetype=xxxxxxx | multikv forceheader=1 | dedup ACCOUNT_CODE DATE MVS_SYSTEM_ID CALCMIPS | eval DATE=strftime(strptime(DATE,"%d%b%y"),"%Y-%m-%d") | lookup Account_file.csv ACCOUNT_CODE OUTPUT Application BusinessUnit ApplicationRTO | eval _time=strptime(DATE." "."00:00:00","%Y-%m-%d %H:%M:%S") | table _time Application BusinessUnit MVS_SYSTEM_ID CALCMIPS 
| eval Application=Application."|".BusinessUnit
| chart avg(CALCMIPS) by Application DATE limit=0
| eval BusinessUnit=mvindex(split(Application,"|"),1)
| eval Application=mvindex(split(Application,"|"),0)
| fields Application BusinessUnit *

[aquinojason]

Thank you very much!