Splunk Search

Bar chart with multiple series

pitmod
Explorer

Hello,

I have the following data

book="title1" reader="reader1"
book="title1" reader="reader1"
book="title1" reader="reader2"
book="title1" reader="reader2"
book="title2" reader="reader1"
book="title2" reader="reader3"
book="title2" reader="reader3"
book="title2" reader="reader3"
...

 

I'd like to represent it in a multi-series bar chart showing number of reads by reader per title as in a drawing below:

count
^
|   _____________     _____________
|   |                                |     |                                 |
|   |_reader1_____|     |                                 |
|   |                                |     |_reader3_____ |
|   |_reader2_____|     |_reader1_____ |
----------------------------------------------------> titles
         title1                                   title 2

Labels (3)
0 Karma
1 Solution

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust
| makeresults | eval _raw="book,reader
title1,reader1
title1,reader1
title1,reader2
title1,reader2
title2,reader1
title2,reader3
title2,reader3
title2,reader3"
| multikv forceheader=1
| stats count  by book,reader
| chart values(count) as count over book by reader
  • use column chart
  • under format in general set "stacked" to stack mode

Note: stacked is middle option of stack mode.

thambisetty_0-1602597042294.png

 

————————————
If this helps, give a like below.
0 Karma

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...