Splunk Search

How can I create a chart for each column?

madisonAvalos
Engager

I have 10 columns with the name of a server, and each server has its average per day. How can I create a panel for each column that I have? In this case, I need to show 10. Any help? Right now, it only shows me everything all in the same panel.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Assuming you currently have a single chart with many colours in one chart, have you tried setting "Multi-series Mode" to Yes in the Format menu? That should split each colour out into its own chart.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Assuming you currently have a single chart with many colours in one chart, have you tried setting "Multi-series Mode" to Yes in the Format menu? That should split each colour out into its own chart.

madisonAvalos
Engager

It works! Thank you sooooo much

One last question
So i have 45 servers with own chart.
Can i put the name of the server on the top of each chart?

0 Karma

woodcock
Esteemed Legend

Show the search that is generating the current panel's table.

0 Karma

madisonAvalos
Engager

i have like this:
DAY| Server1 | server 2 | server 3
1 | 2.3 | 3.2 | 1.2
2 | 1.2 | 0.1 | 3.2

my search:
| dbquery "SCOM/SQL" "SELECT datepart(day,interval) [day], convert(dec(12,2),avg(average2)) [avg], ServerName
FROM [Performance].[vw_ServerShortName] JOIN [Performance].[tbl_PeformanceResult] ON [Performance].[tbl_PeformanceResult].Displayname2=[Performance].[vw_ServerShortName].Displayname2 WHERE Performance='Lync' GROUP BY datepart(day,interval), ServerName;
"| sort by day | chart list(avg) by day, ServerName

So i need:

Name: server 1
chart 1 x->Days Y-> Average
server 2
chart2 x-> Days y -> Average

in the same Dashboard maybe in different panels... But 1 chart per Server

Thankyou

0 Karma

renjith_nair
Legend

Sorry didn't get your requirement fully. Do you mean you have server names as field names and each has a row for average, something like below.

server1 server2 ....server10
90 80 60

It will be great if you could share your current search and dashboard and what you want to achieve

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...