Splunk Search

Combining Multiple Fields in Charting

blurblebot
Communicator

Given a data set with events that fall into X categories and Y subcategories, can I display a chart that shows a column or portion-of-pie or bar for each combination of X/Y?

Example data set

server=main cat=a sub=1
server=alt cat=b sub=1
server=main cat=c sub=1
server=main cat=a sub=2
server=alt cat=b sub=2
server=main cat=c sub=2
server=main cat=b sub=3
server=alt cat=c sub=3

For the chart of the above data, the chart shows one bar for count of all cat=a/sub=1 events, one shows all cat=b/sub=1 events, etc.

Bonus Vocab Quiz: 1) what are the sections (bars, columns, portions of pie) of a chart to be referred to as in splunkese?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
... | eval series=cat."/".sub | chart count by series

I would refer to each section as a "series" or "data series".

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

If you have repeated "sub" values as in your example, you may want to consider a search like:

... | chart count by cat sub

This will make a table like:

cat 1 2 3
--- - - -
a   . . .
b   . . .
c   . . .

This is useful if you want a stacked column chart to be rendered in the UI, so that you can see each combination as well as the total for each category.

gkanapathy
Splunk Employee
Splunk Employee
... | eval series=cat."/".sub | chart count by series

I would refer to each section as a "series" or "data series".

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...