Splunk Search

Can you have 3 fields within a chart

zoebanning
Path Finder

Hi Splunk Community,

I was wondering if it was possible to have a chart that was made up from 3 fields.... 

I have already built a chart that has columns for each Account where each column is stacked with the Action -->  | chart count by Account, Action 


Can i break down into days using the _time field, so it counts by days?

 

Example of data:

_timeAccountAction
2021-10-20 10:04:03.778account1Delete
2021-10-21 11:04:03.778account2Write
2021-10-21 11:05:03.778account1Write

 

Thanks You,

Zoe 

Labels (2)
0 Karma
1 Solution

bhargavi
Path Finder

Hi @zoebanning ,

 

  • Chart command does not allow more than 2 fields  in by clause
  • Timechart command does not allow more than 1 field  in by clause

    So here I have tried to display the possible values of account and action and merged them into 1 column, then used timechart command . 

    bhargavi_0-1636983082422.png



    bhargavi_1-1636983101981.png



    If this helps, give a thumbs-up 🙂

    Happy Splunking!!

View solution in original post

bhargavi
Path Finder

Hi @zoebanning ,

 

  • Chart command does not allow more than 2 fields  in by clause
  • Timechart command does not allow more than 1 field  in by clause

    So here I have tried to display the possible values of account and action and merged them into 1 column, then used timechart command . 

    bhargavi_0-1636983082422.png



    bhargavi_1-1636983101981.png



    If this helps, give a thumbs-up 🙂

    Happy Splunking!!

NobliX
Loves-to-Learn Everything

Regarding the chart. Is there a possibility to hide or remove a column in the column chart based on nullvalue. (The space created visually) ? As of now it is created spaces to 3 bars, thus its only displaying the value of given instance. 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...