Splunk Search

Chart over time by multiple fields

YuliyaVassilyev
Explorer

Hi there! I want to create a scorecard by Manager and Region counting my Orders over Month. So the chart would look something like: 

YuliyaVassilyev_0-1734017277904.png

I have all the fields: Region, Director, Month and Order_Number to make a count. Please let me know if you have an efficient way to do this in SPL. Thank you very much!

 

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @YuliyaVassilyev ,

at first Splunk isn't Excel!

anyway you could try something like this:

<your_search>
| eval col=Region."|".Director
| bin span=1mon _time
| chart count OVER col BY _time
| rex field=col "^(?<Region>[^\|]+)\|(?<Director>.*)"
| fields - col
| table Region Director *
| addcoltotals
| addtotals

 then to add partial totals.

Ciao.

Giuseppe

View solution in original post

0 Karma

YuliyaVassilyev
Explorer

@gcusello that worked great, thank you. Do you also happen to know the best way to add the totals for each carrier like on line 5 and 9 on my example chart? Like appendpipe?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @YuliyaVassilyev ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @YuliyaVassilyev ,

at first Splunk isn't Excel!

anyway you could try something like this:

<your_search>
| eval col=Region."|".Director
| bin span=1mon _time
| chart count OVER col BY _time
| rex field=col "^(?<Region>[^\|]+)\|(?<Director>.*)"
| fields - col
| table Region Director *
| addcoltotals
| addtotals

 then to add partial totals.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...