Splunk Search

Combining separate columns based on x-axis value

sepkarimpour
Path Finder

I initially created a chart that will show log count for a number of hosts: ... | chart count by host source | ... which would show the logs based for each separate host (first image) but I wanted it to only display when the counts don't match.

After some testing, I can produce a table that will display three columns per host when the counts don't match: ... | stats count as num_source by host source | eventstats values(num_source) as num_counts by host | where mvcount(num_counts)>1 | table host num_source | ... (second image), but now it displays the host for each column and are all one colour which isn't clear. Is there a way I can use the chart command so it's similar to the first image but with the data of the second? Thanks.alt text

alt text

1 Solution

DalJeanis
Legend
...
| stats count as num_source by host source 
| eventstats values(num_source) as num_counts by host 
| where mvcount(num_counts)>1 
| table host source num_source 
| chart sum(num_source) as count by host source

View solution in original post

DalJeanis
Legend
...
| stats count as num_source by host source 
| eventstats values(num_source) as num_counts by host 
| where mvcount(num_counts)>1 
| table host source num_source 
| chart sum(num_source) as count by host source
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...