Splunk Search

Column chart based on field value, without everything being the "count" field

jwiley_splunk
Splunk Employee
Splunk Employee

alt text

Currently having a hard time figuring out how to create a column chart where the field values show up in the side, so I can color code them in XML.

My query is bringing back the results into a table, which I then pipe into a count command to create this column chart. The chart is exactly the info I want to see, I just can't figure out how to make color code it, since it's all the "count" field in XML.

| Parent search query
| table Name, (other fields)
| stats count by Name

I've looked all over, but just can't figure it out.

0 Karma
1 Solution

renjith_nair
Legend

@jwiley_splunk ,

Try transpose ing it

| Parent search query
| table Name, (other fields)
| stats count by Name
| transpose 0 header_field=Name
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@jwiley_splunk ,

Try transpose ing it

| Parent search query
| table Name, (other fields)
| stats count by Name
| transpose 0 header_field=Name
---
What goes around comes around. If it helps, hit it with Karma 🙂

jwiley_splunk
Splunk Employee
Splunk Employee

That's almost perfect!

Is there a way to get the original labels back under the columns? alt text

0 Karma

renjith_nair
Legend

@jwiley_splunk ,
Try this and select "stacked" in the format

 | Parent search query
 | table Name, (other fields)
 | eval _tmp=Name
 | chart count over Name by _tmp
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

jwiley_splunk
Splunk Employee
Splunk Employee

You're a saint. Thank you so much Renjith!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...