Splunk Search

How can I show lookups in the Stacked bar graph ?

kiran331
Builder

Hello,

I have 6 lookups, I have to show the stacked bar graph of three types a,b,c with showing active and inactive count?Whats the best way to show this one?

a_active.csv
a_inactive.csv
b_active.csv
b_inactive.csv
c_active.csv
c_inactive.csv

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

Try apppending them, like this
*UPDATED*

| inputlookup a_active.csv | eval File-"A" | eval status="Active" | append [| inputlookup a_inactive.csv | eval File-"A" | eval status="InActive"] | append [| inputlookup b_active.csv | eval File-"B" | eval status="Active" etc etc etc] | chart count over File by status

View solution in original post

0 Karma

sundareshr
Legend

Try apppending them, like this
*UPDATED*

| inputlookup a_active.csv | eval File-"A" | eval status="Active" | append [| inputlookup a_inactive.csv | eval File-"A" | eval status="InActive"] | append [| inputlookup b_active.csv | eval File-"B" | eval status="Active" etc etc etc] | chart count over File by status
0 Karma

kiran331
Builder

Thanks! How can i show active and inactive count in a single bar stacked?

0 Karma

sundareshr
Legend

Try the updated query

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...