Splunk SPL & visualisation

[LogUx]

Hello Splunkers!!

index=messagebus "AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName"="ASR/Hb/*/Entry*" OR "AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName"="ASR/Hb/*/Exit*" | stats count by "AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName"
|fields - _raw | fields AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName | rex field=AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName "(?<location>Aisle\d+)" | fields - AsrLocationStatusUpdate.AsrLocationStatus.LocationQualifiedName |strcat "raw" "," location group_name | stats count BY location group_name

Current visualisation I am getting by above search in column chart: 

I want to obtain below visualization. Please guide me what changes I need to used in my current SPL to obtain below visualization.

[ITWhisperer]

Try changing

| stats count BY location group_name

to

| chart count BY location group_name

then use a stacked column chart

[LogUx]

@ITWhisperer 

Below is the visualization I am getting after changing from stats to chart.

[ITWhisperer]

| timechart span=1d count by location

[LogUx]

@ITWhisperer 

No results, I think strcat is working together with location and group_name

[ITWhisperer]

The visualisation you said you wanted doesn't have raw.location in. Please clarify what you want in your visualisation, what fields you have and how you want to use them

[LogUx]

@ITWhisperer group_name is the raw.location and in the visualisation they are using. I want the same Visualisation as mentioned earlier.

[ITWhisperer]

| timechart span=1d count by group_name

[LogUx]

@ITWhisperer Thats also not workng.

See the below events from the search and want the expected visualization.

[ITWhisperer]

I think you may have been told this before but if you want a time element in your visualisation, it needs to be in your results table. Your search is removing the _time field (or not including it). You need to rework your search accordingly.

[LogUx]

@ITWhisperer 

I have included _time in my search, and the results are still the same.

[ITWhisperer · Accepted solution]

Try this

| timechart span=1d count by location