Splunk Search

Combining Multiple Fields in Charting

blurblebot
Communicator

Given a data set with events that fall into X categories and Y subcategories, can I display a chart that shows a column or portion-of-pie or bar for each combination of X/Y?

Example data set

server=main cat=a sub=1
server=alt cat=b sub=1
server=main cat=c sub=1
server=main cat=a sub=2
server=alt cat=b sub=2
server=main cat=c sub=2
server=main cat=b sub=3
server=alt cat=c sub=3

For the chart of the above data, the chart shows one bar for count of all cat=a/sub=1 events, one shows all cat=b/sub=1 events, etc.

Bonus Vocab Quiz: 1) what are the sections (bars, columns, portions of pie) of a chart to be referred to as in splunkese?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
... | eval series=cat."/".sub | chart count by series

I would refer to each section as a "series" or "data series".

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

If you have repeated "sub" values as in your example, you may want to consider a search like:

... | chart count by cat sub

This will make a table like:

cat 1 2 3
--- - - -
a   . . .
b   . . .
c   . . .

This is useful if you want a stacked column chart to be rendered in the UI, so that you can see each combination as well as the total for each category.

gkanapathy
Splunk Employee
Splunk Employee
... | eval series=cat."/".sub | chart count by series

I would refer to each section as a "series" or "data series".

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...