Splunk Search

Chart over time by multiple fields

YuliyaVassilyev
Explorer

Hi there! I want to create a scorecard by Manager and Region counting my Orders over Month. So the chart would look something like: 

YuliyaVassilyev_0-1734017277904.png

I have all the fields: Region, Director, Month and Order_Number to make a count. Please let me know if you have an efficient way to do this in SPL. Thank you very much!

 

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @YuliyaVassilyev ,

at first Splunk isn't Excel!

anyway you could try something like this:

<your_search>
| eval col=Region."|".Director
| bin span=1mon _time
| chart count OVER col BY _time
| rex field=col "^(?<Region>[^\|]+)\|(?<Director>.*)"
| fields - col
| table Region Director *
| addcoltotals
| addtotals

 then to add partial totals.

Ciao.

Giuseppe

View solution in original post

0 Karma

YuliyaVassilyev
Explorer

@gcusello that worked great, thank you. Do you also happen to know the best way to add the totals for each carrier like on line 5 and 9 on my example chart? Like appendpipe?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @YuliyaVassilyev ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @YuliyaVassilyev ,

at first Splunk isn't Excel!

anyway you could try something like this:

<your_search>
| eval col=Region."|".Director
| bin span=1mon _time
| chart count OVER col BY _time
| rex field=col "^(?<Region>[^\|]+)\|(?<Director>.*)"
| fields - col
| table Region Director *
| addcoltotals
| addtotals

 then to add partial totals.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...