Splunk Search

Display data on single bar line in chart

rvisj
New Member

I have some records in csv, each record has a column 'payment method'. I have to count by 'payment method' and the result should how in single line in chart
Each color in chart represents a payment method
Expected

Tags (3)
0 Karma
1 Solution

adonio
Ultra Champion

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps
alt text

alt text

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

Your Base Search Here | eval label="Payment Methods" | contingency label "payment method" | search label!="TOTAL"

Set the visualization to Bar Chart and set the Stack Mode to the one on the right (stacked).

0 Karma

rvisj
New Member

thanks for your reply. I tried this but 'Total' is coming as a payment method and adding up in the chart

0 Karma

woodcock
Esteemed Legend

Also add | fields - Total TOTAL to the end.

0 Karma

adonio
Ultra Champion

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps
alt text

alt text

0 Karma

rvisj
New Member

Working..thanks @adonio. Can we remover that 'var 1' label from Y-axis

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...