Splunk Search

Bar chart with multiple series

pitmod
Explorer

Hello,

I have the following data

book="title1" reader="reader1"
book="title1" reader="reader1"
book="title1" reader="reader2"
book="title1" reader="reader2"
book="title2" reader="reader1"
book="title2" reader="reader3"
book="title2" reader="reader3"
book="title2" reader="reader3"
...

 

I'd like to represent it in a multi-series bar chart showing number of reads by reader per title as in a drawing below:

count
^
|   _____________     _____________
|   |                                |     |                                 |
|   |_reader1_____|     |                                 |
|   |                                |     |_reader3_____ |
|   |_reader2_____|     |_reader1_____ |
----------------------------------------------------> titles
         title1                                   title 2

Labels (3)
0 Karma
1 Solution

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust
| makeresults | eval _raw="book,reader
title1,reader1
title1,reader1
title1,reader2
title1,reader2
title2,reader1
title2,reader3
title2,reader3
title2,reader3"
| multikv forceheader=1
| stats count  by book,reader
| chart values(count) as count over book by reader
  • use column chart
  • under format in general set "stacked" to stack mode

Note: stacked is middle option of stack mode.

thambisetty_0-1602597042294.png

 

————————————
If this helps, give a like below.
0 Karma

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...