Chart over time by multiple fields

[YuliyaVassilyev]

Hi there! I want to create a scorecard by Manager and Region counting my Orders over Month. So the chart would look something like: 

YuliyaVassilyev_0-1734017277904.png

I have all the fields: Region, Director, Month and Order_Number to make a count. Please let me know if you have an efficient way to do this in SPL. Thank you very much!

[YuliyaVassilyev]

@gcusello that worked great, thank you. Do you also happen to know the best way to add the totals for each carrier like on line 5 and 9 on my example chart? Like appendpipe?

[gcusello]

Hi @YuliyaVassilyev ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @YuliyaVassilyev ,

in Community, there are many solutions to your request, see at

https://community.splunk.com/t5/Splunk-Search/How-do-I-combine-subtotals-and-totals-in-a-search-quer...

https://community.splunk.com/t5/Splunk-Search/How-do-I-edit-my-search-to-get-both-subtotals-and-the-...

https://community.splunk.com/t5/Splunk-Search/Show-subtotals-in-results-table/m-p/102875

https://community.splunk.com/t5/Splunk-Search/How-to-add-sub-totals-to-a-table/m-p/317028

Test them.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello · Accepted solution]

Hi @YuliyaVassilyev ,

at first Splunk isn't Excel!

anyway you could try something like this:

<your_search>
| eval col=Region."|".Director
| bin span=1mon _time
| chart count OVER col BY _time
| rex field=col "^(?<Region>[^\|]+)\|(?<Director>.*)"
| fields - col
| table Region Director *
| addcoltotals
| addtotals

 then to add partial totals.

Ciao.

Giuseppe