Splunk Search

Combining Multiple Fields in Charting

blurblebot
Communicator

Given a data set with events that fall into X categories and Y subcategories, can I display a chart that shows a column or portion-of-pie or bar for each combination of X/Y?

Example data set

server=main cat=a sub=1
server=alt cat=b sub=1
server=main cat=c sub=1
server=main cat=a sub=2
server=alt cat=b sub=2
server=main cat=c sub=2
server=main cat=b sub=3
server=alt cat=c sub=3

For the chart of the above data, the chart shows one bar for count of all cat=a/sub=1 events, one shows all cat=b/sub=1 events, etc.

Bonus Vocab Quiz: 1) what are the sections (bars, columns, portions of pie) of a chart to be referred to as in splunkese?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
... | eval series=cat."/".sub | chart count by series

I would refer to each section as a "series" or "data series".

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

If you have repeated "sub" values as in your example, you may want to consider a search like:

... | chart count by cat sub

This will make a table like:

cat 1 2 3
--- - - -
a   . . .
b   . . .
c   . . .

This is useful if you want a stacked column chart to be rendered in the UI, so that you can see each combination as well as the total for each category.

gkanapathy
Splunk Employee
Splunk Employee
... | eval series=cat."/".sub | chart count by series

I would refer to each section as a "series" or "data series".

Get Updates on the Splunk Community!

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...