Splunk Enterprise Security

How do I display 2 lines on a line graph? The fields used are "MatlTemp" and "Hour" and it is sorted by "Batch"

donny__0
Engager

I am using 2 csv files and the "inputlookup" method.  Right now I am appending one of the csv to another csv, but the line chart that is displayed out only have one line. Both of the csv files has the same fields but i want the the graph to have 2 lines, one line for the first "batch" and the second line for the second "Batch" . How do I write the codes to let the graph get sorted by the "Batch" number so there will be 2 lines?

Current codes : 

 | from inputlookup:"5019609_V-094_9007270566.csv"| append [| from inputlookup "5019609_V-094_9007280926.csv"] |  fields  Hr  MatlTemp

Current Picture of line graph :

donny__0_1-1615533293110.png

 

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
You could rename one of those MatlTemp eg. MatlTemp2 inside append and add also that field to the end of fields.

donny__0
Engager

Okay a second line appeared but is it there a solution to sort the line chart by fields instead? I have a big data so its not efficient to rename the fields every time I want to compare a new set of data. If there is a sorting solution then the data would automatically be sorted by the "Batch" number. Thank You!

 

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...