Splunk Search

How do you make a chart with repeating x axis values?

sriharsha14
New Member

Hi all,

I have 2 columns like that I want to plot:
x y
1579 1
1707 2
1707 3
1707 4
1707 5
1707 6
1707 7
1707 8
1707 9
1707 10

When I see the visualization with this search command:

source="splunk_test1.txt" host="Sriharshas-MacBook-Pro.local" sourcetype="temp" | table x, y | sort y

I get a plot like this:
alt text

But I am looking for a plot like this:
alt text

What should be my search command to get the required plot?

Thanks in advance!

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

source="splunk_test1.txt" host="Sriharshas-MacBook-Pro.local" sourcetype="temp" | table x, y | sort y | stats max(x) by y

Instead of max(x), you could also try sum(x), depending on what that data represents

0 Karma

sriharsha14
New Member

This command:

    source="splunk_test1.txt" sourcetype="temp" | table x, y | sort y | stats sum(x) as x1 by y | sort y

treats x1 as integer, but the plot is with x and y axis interchanged.

When I do this:

    source="splunk_test1.txt" sourcetype="temp" | table x, y | sort y | stats sum(x) as x1 by y | sort y | table x1, y

I get the same plot as the one in the question.

It looks like, with repeating x-axis values (to generate a vertical line), the plotting routine changes the data type of the x-axis values.

I also tried this command to avoid repeating x-axis values:

source="splunk_test1.txt" sourcetype="temp" | table x, y | sort y | eval x = x+y

Even with this, I get the similar plot as the one in question

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...