Splunk Search

Bar chart with multiple series

pitmod
Explorer

Hello,

I have the following data

book="title1" reader="reader1"
book="title1" reader="reader1"
book="title1" reader="reader2"
book="title1" reader="reader2"
book="title2" reader="reader1"
book="title2" reader="reader3"
book="title2" reader="reader3"
book="title2" reader="reader3"
...

 

I'd like to represent it in a multi-series bar chart showing number of reads by reader per title as in a drawing below:

count
^
|   _____________     _____________
|   |                                |     |                                 |
|   |_reader1_____|     |                                 |
|   |                                |     |_reader3_____ |
|   |_reader2_____|     |_reader1_____ |
----------------------------------------------------> titles
         title1                                   title 2

Labels (3)
0 Karma
1 Solution

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust
| makeresults | eval _raw="book,reader
title1,reader1
title1,reader1
title1,reader2
title1,reader2
title2,reader1
title2,reader3
title2,reader3
title2,reader3"
| multikv forceheader=1
| stats count  by book,reader
| chart values(count) as count over book by reader
  • use column chart
  • under format in general set "stacked" to stack mode

Note: stacked is middle option of stack mode.

thambisetty_0-1602597042294.png

 

————————————
If this helps, give a like below.
0 Karma

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Enterprise Security: An Automated Phishing Response Workflow

Originally posted on Splunk.com.   Key takeaways  The volume of phishing emails can overwhelm even the most ...

Sharper ES Detections, Agentic AI Integrations, Smarter Workload Management, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...