Splunk Search

Combining separate columns based on x-axis value

sepkarimpour
Path Finder

I initially created a chart that will show log count for a number of hosts: ... | chart count by host source | ... which would show the logs based for each separate host (first image) but I wanted it to only display when the counts don't match.

After some testing, I can produce a table that will display three columns per host when the counts don't match: ... | stats count as num_source by host source | eventstats values(num_source) as num_counts by host | where mvcount(num_counts)>1 | table host num_source | ... (second image), but now it displays the host for each column and are all one colour which isn't clear. Is there a way I can use the chart command so it's similar to the first image but with the data of the second? Thanks.alt text

alt text

1 Solution

DalJeanis
SplunkTrust
SplunkTrust
...
| stats count as num_source by host source 
| eventstats values(num_source) as num_counts by host 
| where mvcount(num_counts)>1 
| table host source num_source 
| chart sum(num_source) as count by host source

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust
...
| stats count as num_source by host source 
| eventstats values(num_source) as num_counts by host 
| where mvcount(num_counts)>1 
| table host source num_source 
| chart sum(num_source) as count by host source
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...