Splunk Search
Highlighted

Display data on single bar line in chart

New Member

I have some records in csv, each record has a column 'payment method'. I have to count by 'payment method' and the result should how in single line in chart
Each color in chart represents a payment method
Expected

Tags (3)
0 Karma
Highlighted

Re: Display data on single bar line in chart

SplunkTrust
SplunkTrust

hello @rvisj
here i user an Instrumental Variable (... | eval var=1 )to use the chart command for the visualization you requested
in screenshot 1 you will see the lookup i created.
screenshot 2 has the search i used and bar chart
heres the search: | inputlookup payments.csv | eval var=1 | chart count(record) over var by payment_method
hope it helps
alt text

alt text

View solution in original post

0 Karma
Highlighted

Re: Display data on single bar line in chart

New Member

Working..thanks @adonio. Can we remover that 'var 1' label from Y-axis

0 Karma
Highlighted

Re: Display data on single bar line in chart

Esteemed Legend

Like this:

Your Base Search Here | eval label="Payment Methods" | contingency label "payment method" | search label!="TOTAL"

Set the visualization to Bar Chart and set the Stack Mode to the one on the right (stacked).

0 Karma
Highlighted

Re: Display data on single bar line in chart

New Member

thanks for your reply. I tried this but 'Total' is coming as a payment method and adding up in the chart

0 Karma
Highlighted

Re: Display data on single bar line in chart

Esteemed Legend

Also add | fields - Total TOTAL to the end.

0 Karma