Splunk Search

Display data on single bar line in chart

rvisj
New Member

I have some records in csv, each record has a column 'payment method'. I have to count by 'payment method' and the result should how in single line in chart
Each color in chart represents a payment method
Expected

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps
alt text

alt text

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here | eval label="Payment Methods" | contingency label "payment method" | search label!="TOTAL"

Set the visualization to Bar Chart and set the Stack Mode to the one on the right (stacked).

0 Karma

rvisj
New Member

thanks for your reply. I tried this but 'Total' is coming as a payment method and adding up in the chart

0 Karma

woodcock
Esteemed Legend

Also add | fields - Total TOTAL to the end.

0 Karma

adonio
Ultra Champion

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps
alt text

alt text

0 Karma

rvisj
New Member

Working..thanks @adonio. Can we remover that 'var 1' label from Y-axis

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...