Splunk Search

Chart with count statistics associated time from multiple table

splunksuperman
Explorer

Hi Guys,

I have one master list that inculdes all items, and I want to consolidate two other time-related tables into a single chart, as shown in the example below.

  • master list

total.png

  • time-related table 1

1.png

  • time-related table 2

2.png

  • result chart

result.png

And could I use the chart to produce the pivot chart in Splunk?

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| makeresults format=csv data="no,item
1,A
2,B
3,C
4,D
5,E"
| append
    [| makeresults format=csv data="date,item
    2024/10/1,A
    2024/10/1,B
    2024/10/1,C"]
| append
    [| makeresults format=csv data="date,item
    2024/10/2,C
    2024/10/2,D"]
``` The lines above represent your sample data appended together ```
| chart count by item date
| fields - NULL
| untable item date count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| makeresults format=csv data="no,item
1,A
2,B
3,C
4,D
5,E"
| append
    [| makeresults format=csv data="date,item
    2024/10/1,A
    2024/10/1,B
    2024/10/1,C"]
| append
    [| makeresults format=csv data="date,item
    2024/10/2,C
    2024/10/2,D"]
``` The lines above represent your sample data appended together ```
| chart count by item date
| fields - NULL
| untable item date count

splunksuperman
Explorer

You are so great!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...