- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunksuperman
Explorer
10-29-2024
02:51 AM
Hi Guys,
I have one master list that inculdes all items, and I want to consolidate two other time-related tables into a single chart, as shown in the example below.
- master list
- time-related table 1
- time-related table 2
- result chart
And could I use the chart to produce the pivot chart in Splunk?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
10-29-2024
07:41 AM
Try something like this
| makeresults format=csv data="no,item
1,A
2,B
3,C
4,D
5,E"
| append
[| makeresults format=csv data="date,item
2024/10/1,A
2024/10/1,B
2024/10/1,C"]
| append
[| makeresults format=csv data="date,item
2024/10/2,C
2024/10/2,D"]
``` The lines above represent your sample data appended together ```
| chart count by item date
| fields - NULL
| untable item date count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
10-29-2024
07:41 AM
Try something like this
| makeresults format=csv data="no,item
1,A
2,B
3,C
4,D
5,E"
| append
[| makeresults format=csv data="date,item
2024/10/1,A
2024/10/1,B
2024/10/1,C"]
| append
[| makeresults format=csv data="date,item
2024/10/2,C
2024/10/2,D"]
``` The lines above represent your sample data appended together ```
| chart count by item date
| fields - NULL
| untable item date count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
splunksuperman
Explorer
10-29-2024
05:33 PM
You are so great!
