Charting the 2 fields on the same chart.

[justinfranks]

I have a log of login timestamps. I would like to display the total count and total unique value count on the same bar chart.

Here is my search:

sourcetype="etv" cname="*" ur="*" | stats dc(u) as "unique", count by u | chart sum(count) as "Total Logins", sum(unique) as "Total Unique Logins"

Where 'u' is the UserID.

However, this search charts the "Total Logins" by "Total Unique Logins", which is not what I want.

Is there a way chart this information, split by their field names?

[lguinn2 · Accepted solution]

Would this work

sourcetype="etv" cname="*" ur="*" 
| stats dc(u) as "Total Unique Logins" count as "Total Logins"
| transpose

And then choose the Visualization tab

(After some thought, I figured out that you can simplify your calculations.)

[justinfranks]

Thanks! The transpose command was what I was missing.

[lguinn2]

sourcetype="etv" cname="*" ur="*" 
| stats dc(u) as "unique", count by u 
| stats sum(count) as "Total Logins", sum(unique) as "Total Unique Logins"

should work

[justinfranks]

I thought so too but here is what I get:

http://i.imgur.com/UR0dLKB.png

However, I'd like to have them on different bars of the count on the bottom.

[rsennett_splunk]

Incidentally... Depending on the difference between total logins and unique logins, you may need to set the y-axis to "log" rather than "linear" in order to see the relationship between them.