Splunk Search
Highlighted

How to chart multiple fields over time on one graph and create a table summarizing totals by user?

New Member

Using the base search listed below it presents me with all print jobs, one print job per user. I would like to chart the fields "Total Pages" by "Full Name" for all users(all results) over time on one graph. In total there are around 37 users and several random "Total Page" counts. Thinking of using a line graph. What would be the best way to complete this?

I then would like to create a table that totals all pages printed by user. So adding the "Total Pages" field, by "Full Name" in a table.

Base Search:

index="win_custom" sourcetype="print-job-accounting-report" 

alt text

Thank you!

0 Karma
Highlighted

Re: How to chart multiple fields over time on one graph and create a table summarizing totals by user?

SplunkTrust
SplunkTrust

Hi @cpalicensing,

Does this work for you ?

Chart

index="win_custom" sourcetype="print-job-accounting-report"|timechart span=1d values("Total Pages") by "Full Name"

If this doesn't fit , please let us know what aggregation you want to do on "Total Pages". Also adjust the span min,day,hour etc

Table

    index="win_custom" sourcetype="print-job-accounting-report"|stats sum("Total Pages") by "Full Name"

View solution in original post

0 Karma