Splunk Search

Creating a line graph based on two different medians

wajeeh911
Engager

I have a table below in splunk. I'm trying the create a line graph which would graph four lines. The X axis would be the bypass value. The Y axis would be the the 50th percentile and 80th percentile of Type3 and and the 50th and 80th percentile of Type4. But there doesn't seem to be a way to do a stats, eval, if statement. 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@wajeeh911 

See this example - it first creates a similar data sample set to your data then just uses the chart statement to do what you describe.

| makeresults 
| eval n=mvrange(1,31)
| mvexpand n
| eval Type="Type".(random() % 2 + 3)
| eval Bypass="S".(random() % 3 + 37)
| eval TotalTime=random() % 15 + (random() / 100000)
| table TotalTime Bypass Type
| chart perc50(TotalTime) as p50 perc80(TotalTime) as p80 over Bypass by Type

Hope this helps

 

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...