Splunk Search

How can I Overlay chart with two fields?

indeed_2000
Motivator

Hi 

I have two fields: target (server1, server2,…) , status count by (ok,nokey)

how can i show these fields on timechart? (I mean overlay chart)


stack bar chart show count of status by target?

any idea?

 Thanks 

Labels (4)
Tags (4)
0 Karma
1 Solution

gcusello
Legend

Hi @indeed_2000,

please try this:

your_search
| bin span=1h _time
| stats count(eval(status="ok")) AS OK count(eval(status="nok")) AS NOK by target _time

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @indeed_2000,

please try this:

your_search
| bin span=1h _time
| stats count(eval(status="ok")) AS OK count(eval(status="nok")) AS NOK by target _time

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust
| timechart count by target

This should give you counts for each target against each time value.

When visualised, the timeline will be the x-axis, and you should have a line (for line chart) or column (for column chart) etc. for each series (target)

If you want, you can select one or more of these series as an overlay line on a column chart.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...