Although I get a lot of hits for these keywords, I'm not having much luck finding a solution. Have tried timechart also.
I have: search... | chart sum(count) AS Total over DIRECTION by ATTACH (I was also using 'addtotals' for that which was a nice feature)
to get below:
DIRECTION | HAS_ATTACH | NO_ATTACH
Inbound | 2491 | 338
Outbound | 568 | 2792
But I also want the date, but not in this format: | stats count by Date, DIRECTION, ATTACH
Date | DIRECTION | ATTACH | count
2014-08-05 | Inbound | HAS_ATTACH | 2491
2014-08-05 | Inbound | NO_ATTACH | 338
2014-08-05 | Outbound | HAS_ATTACH | 568
2014-08-05 | Outbound | NO_ATTACH | 2792
I'd like to have the format as follows - any suggestions?
Date | DIRECTION | HAS_ATTACH | NO_ATTACH
2014-08-05 | Inbound | 2491 | 338
2014-08-05 | Outbound | 568 | 2792
I had a similar use case. I was told that you can't chart over two series in Splunk (as you can in Excel). My solution:
| eval Date_Direction=Date + ":" + DIRECTION
| chart sum(count) AS Total over Date_Direction by ATTACH
You get a clean chart, but lose the ability to use Date and Direction for further processing.
If you want to use Date and Direction and don't mind table format, here is a quirky method:
| eval Date_Direction=Date + ":" + DIRECTION
| chart sum(count) AS Total over Date_Direction by ATTACH
| rex field=Date_Direction "(?<Date>[^:]+):(?<DIRECTION>.*)"
| fields - Date_Direction
This gives you the table you want (somewhat different field orders), but you lose meaningful visualization.
I had a similar use case. I was told that you can't chart over two series in Splunk (as you can in Excel). My solution:
| eval Date_Direction=Date + ":" + DIRECTION
| chart sum(count) AS Total over Date_Direction by ATTACH
You get a clean chart, but lose the ability to use Date and Direction for further processing.
If you want to use Date and Direction and don't mind table format, here is a quirky method:
| eval Date_Direction=Date + ":" + DIRECTION
| chart sum(count) AS Total over Date_Direction by ATTACH
| rex field=Date_Direction "(?<Date>[^:]+):(?<DIRECTION>.*)"
| fields - Date_Direction
This gives you the table you want (somewhat different field orders), but you lose meaningful visualization.
That is a very smart way for doing this.
Okay thanks, I had seen that work around at: http://answers.splunk.com/answers/66471/timechart-with-each-line-defined-by-multiple-fields
If this is true (which I was starting to assume): "you can't chart over two series in Splunk" then I can live with your solution.
Thanks.