I'm looking to create a grouped bar chart from data in the following format:
---- ID Results
1: AAA, B321
2: AAA, A918
3: AAA, C391
4: BBB, A918
5: BBB, C391
6: CCC, B321
7: CCC, A918
Essentially I would like to easily visualize which ID has the same results. My idea is to have a bar chart with the IDs listed along the 'X' and then above each ID a 1 unit stacked colour bar representing a result.
If I run a search for:
Results=* | chart Values(Result) by ID
I get the table shown below but the graph view is just axis.
ID ---------Results
AAA---------B321, A918, C391
BBB---------A918, C391
CCC---------B321, A918,
Try
... | chart dc(Results) over ID by Results
Try
... | chart dc(Results) over ID by Results
The source data is something like:
1: AAA, B321
2: AAA, A918
3: AAA, C391
4: BBB, A918
5: BBB, C391
6: CCC, B321
7: CCC, A918
I'm not certain that you are providing the source data. It appears you're providing what splunk gives you when you run the search string you've listed. We need the source data that you're running the search string on in order to help you.