Splunk Search

How do I get my SPLUNK csv excel data to display via a horizontal bar chart?

vstrash
New Member

My data displays in splunk and ![I was able to generate a correct table via running the command index=cmadam host=kot source= "/media/sf_aaa/log1.csv" | multikv | table PRODUCT_ID_, CDC_DVN_VERSION_, SUM_VALUE_ which covers all my needed variables at the moment. My goal is a table similar to thisalt text
When I press visualization I create a graph where the axis are correctly labeled, but no bars show up. What commands are best for creating this visualizations. I'd like the x to be CDC_DVN_VERSION_ and the y to be SUM_VALUE_ which can be filtered by a changing PRODUCT_ID_ later to be defined. Thanks.

Tags (1)
0 Karma

somesoni2
Revered Legend

For your bar chart, you can use commands like these

your base search | stats sum("SUM_VALUE_") as SUM_VALUE by CDC_DVN_VERSION_ 

OR

your base search | chart sum("SUM_VALUE_") as SUM_VALUE by CDC_DVN_VERSION_ 

To add PRODUCT_ID_, as filter, create a form input with token productid and use the token as filter in your base search

your base search PRODUCT_ID_="$productid$" | chart sum("SUM_VALUE_") as SUM_VALUE by CDC_DVN_VERSION_ 

See this for examples for how to create form/form input.
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Buildandeditforms

0 Karma

vstrash
New Member

The above chart is what I hope to mimic or create similar to.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...