Splunk Search

How to add a column to a chart?

andrewygray
New Member

I am trying to add a column to my current chart which has "Customers" as one column and "Users" as another.

e.g.                 Customers                                              Users
                     Wells fargo                                            abc@wf.com
                                                                            123@wf.com
                                                                            TestAccount@wf.com

                     UBS                                                    lol@ubs.com
                                                                            TestAccount2@ubs.com

But I want to make a third column of all the test accounts for each customer like so:

e.g.                     Customers                          Users                             Test Accounts
                         Wells fargo                        abc@wf.com                        TestAccount@wf.com   
                                                            123@wf.com

                         UBS                                lol@ubs.com                       TestAccount2@ubs.com

I know I can filter on the userid so I am able to get two separate charts but I don't know how to merge them. Can someone help?

Here are my searches for each chart:

index=info | chart values(userid) by Customer_Name | rename values(userid) as "User", Customer_Name as "Customer"

index=info userid="TestAccount*" | chart values(userid) by Customer_Name | rename values(userid) as "User", Customer_Name as "Customer"   
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this
Updated

index=info | stats values(userid) as userid by Customer_Name 
| eval User=mvfilter(NOT match(userid,"TestAccount"))
| eval TestAccount=mvfilter(match(userid,"TestAccount"))
| rename Customer_Name as Customer
| table Customer User TestAccount

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this
Updated

index=info | stats values(userid) as userid by Customer_Name 
| eval User=mvfilter(NOT match(userid,"TestAccount"))
| eval TestAccount=mvfilter(match(userid,"TestAccount"))
| rename Customer_Name as Customer
| table Customer User TestAccount
0 Karma

DalJeanis
Legend

@somesoni2 - missing open paren on second mvfilter.

andrewygray
New Member

Thank you! This is exactly what I needed

0 Karma

somesoni2
Revered Legend

Thank you sir.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...