Splunk Search

Bar chart with multiple series

pitmod
Explorer

Hello,

I have the following data

book="title1" reader="reader1"
book="title1" reader="reader1"
book="title1" reader="reader2"
book="title1" reader="reader2"
book="title2" reader="reader1"
book="title2" reader="reader3"
book="title2" reader="reader3"
book="title2" reader="reader3"
...

 

I'd like to represent it in a multi-series bar chart showing number of reads by reader per title as in a drawing below:

count
^
|   _____________     _____________
|   |                                |     |                                 |
|   |_reader1_____|     |                                 |
|   |                                |     |_reader3_____ |
|   |_reader2_____|     |_reader1_____ |
----------------------------------------------------> titles
         title1                                   title 2

Labels (3)
0 Karma
1 Solution

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust
| makeresults | eval _raw="book,reader
title1,reader1
title1,reader1
title1,reader2
title1,reader2
title2,reader1
title2,reader3
title2,reader3
title2,reader3"
| multikv forceheader=1
| stats count  by book,reader
| chart values(count) as count over book by reader
  • use column chart
  • under format in general set "stacked" to stack mode

Note: stacked is middle option of stack mode.

thambisetty_0-1602597042294.png

 

————————————
If this helps, give a like below.
0 Karma

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...