Splunk Search

Chart and trellis

prettysunshinez
Explorer

Hi All,

Would like to know if something like this will work or will there be any other possible solutions.

Chart count over field1 by field2, field3
And i would want to visualise the chart in trellis mode on the basis of field3.

Kindly suggest.
Thanks in advance

0 Karma
1 Solution

niketn
Legend

@prettysunshinez chart will not allow three field aggregation so you may have to stats with eval {field2}= aggregation

<yourCurrentSearch>
| stats count by field1 field2 field3
| eval {field2}=count
| fields - field2 count

Then choose trellis by field3

Following is a run anywhere example based on Splunk's _internal index that can be used to split by component and display count over date_hour by log_level

index=_internal sourcetype=splunkd log_level!=INFO
| stats count by date_hour log_level component
| eval {log_level}=count
| fields - count log_level
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@prettysunshinez chart will not allow three field aggregation so you may have to stats with eval {field2}= aggregation

<yourCurrentSearch>
| stats count by field1 field2 field3
| eval {field2}=count
| fields - field2 count

Then choose trellis by field3

Following is a run anywhere example based on Splunk's _internal index that can be used to split by component and display count over date_hour by log_level

index=_internal sourcetype=splunkd log_level!=INFO
| stats count by date_hour log_level component
| eval {log_level}=count
| fields - count log_level
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

prettysunshinez
Explorer

Thank you so much..It helped!!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...