Splunk Search

Display data on single bar line in chart

rvisj
New Member

I have some records in csv, each record has a column 'payment method'. I have to count by 'payment method' and the result should how in single line in chart
Each color in chart represents a payment method
Expected

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps
alt text

alt text

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here | eval label="Payment Methods" | contingency label "payment method" | search label!="TOTAL"

Set the visualization to Bar Chart and set the Stack Mode to the one on the right (stacked).

0 Karma

rvisj
New Member

thanks for your reply. I tried this but 'Total' is coming as a payment method and adding up in the chart

0 Karma

woodcock
Esteemed Legend

Also add | fields - Total TOTAL to the end.

0 Karma

adonio
Ultra Champion

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps
alt text

alt text

0 Karma

rvisj
New Member

Working..thanks @adonio. Can we remover that 'var 1' label from Y-axis

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...