Splunk Search

Display data on single bar line in chart

rvisj
New Member

I have some records in csv, each record has a column 'payment method'. I have to count by 'payment method' and the result should how in single line in chart
Each color in chart represents a payment method
Expected

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps
alt text

alt text

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here | eval label="Payment Methods" | contingency label "payment method" | search label!="TOTAL"

Set the visualization to Bar Chart and set the Stack Mode to the one on the right (stacked).

0 Karma

rvisj
New Member

thanks for your reply. I tried this but 'Total' is coming as a payment method and adding up in the chart

0 Karma

woodcock
Esteemed Legend

Also add | fields - Total TOTAL to the end.

0 Karma

adonio
Ultra Champion

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps
alt text

alt text

0 Karma

rvisj
New Member

Working..thanks @adonio. Can we remover that 'var 1' label from Y-axis

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...