Splunk Search

Can I split a field based on its values and graph as multi-series?

jheney
New Member

I have a single numeric field that I want to timechart in ranges...i.e. rangemap the field into custom buckets, then timechart with a count by range. Because if the nature of the data, there are WAY more instances of "0" than any other value, making it difficult to interpret the non-zero values. I'd like to treat the 0 values as a different field, then create a timechart that has a count of the 0 values on one Y-axis and a stacked column of the other range values on a second Y-axis. Is such a thing possible? My simple search thus far looks like...

search RF-DELTA| rangemap field=RF-DELTA 0=0-0, 1-10=1-10, 11-20=11-20, 21-30=21-30, 31-40=31-40, 41-50=41-50, default=>50 | timechart span=1d count by range

I guess I need to understand whether I can split out the 0 values as a separate field AND if I can create a multi-axis timechart. Thanks in advance!

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can do the multi-axis timechart since Splunk 6.1.

As for splitting the fields, no real need to do that. If you do a count by range you can specify the 0 field to be charted on a second Y-axis as a line on top of your column chart.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...