Splunk Search

Chart with count statistics associated time from multiple table

splunksuperman
Explorer

Hi Guys,

I have one master list that inculdes all items, and I want to consolidate two other time-related tables into a single chart, as shown in the example below.

  • master list

total.png

  • time-related table 1

1.png

  • time-related table 2

2.png

  • result chart

result.png

And could I use the chart to produce the pivot chart in Splunk?

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| makeresults format=csv data="no,item
1,A
2,B
3,C
4,D
5,E"
| append
    [| makeresults format=csv data="date,item
    2024/10/1,A
    2024/10/1,B
    2024/10/1,C"]
| append
    [| makeresults format=csv data="date,item
    2024/10/2,C
    2024/10/2,D"]
``` The lines above represent your sample data appended together ```
| chart count by item date
| fields - NULL
| untable item date count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| makeresults format=csv data="no,item
1,A
2,B
3,C
4,D
5,E"
| append
    [| makeresults format=csv data="date,item
    2024/10/1,A
    2024/10/1,B
    2024/10/1,C"]
| append
    [| makeresults format=csv data="date,item
    2024/10/2,C
    2024/10/2,D"]
``` The lines above represent your sample data appended together ```
| chart count by item date
| fields - NULL
| untable item date count

splunksuperman
Explorer

You are so great!

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 3)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...