Splunk Search

Combining separate columns based on x-axis value

Path Finder

I initially created a chart that will show log count for a number of hosts: ... | chart count by host source | ... which would show the logs based for each separate host (first image) but I wanted it to only display when the counts don't match.

After some testing, I can produce a table that will display three columns per host when the counts don't match: ... | stats count as numsource by host source | eventstats values(numsource) as numcounts by host | where mvcount(numcounts)>1 | table host num_source | ... (second image), but now it displays the host for each column and are all one colour which isn't clear. Is there a way I can use the chart command so it's similar to the first image but with the data of the second? Thanks.alt text

alt text


Re: Combining separate columns based on x-axis value

| stats count as num_source by host source 
| eventstats values(num_source) as num_counts by host 
| where mvcount(num_counts)>1 
| table host source num_source 
| chart sum(num_source) as count by host source

View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.