How to chart when using multiple matches

[dwestbrook]

I have a search which matches multiple values and produces two events as a list. I'd like to basically make it so that the values in eventA are the X axis, the values in eventB are the Y axis, and as more events are found they sum on eventB, grouped by their values in eventA.

I basically have rows in my log which look like: timestamp some text some text: [2s,189] [5s,23] [10s,13] [20s,3] [30s,0]

This is an example of the events my search is finding:

desiredBucket:

                      2s
                      5s
                      10s
                      20s
                      30s

desiredValue:

                       189
                       23
                       13
                       3
                       0

I can't get this to chart with the following X, Y pairings:

                       [2s, 189]
                       [5s, 23]
                       [10s, 13]
                       [20s, 3]
                       [30s, 0]

But instead, I'm getting things like this:

                       [2s, 228]
                       [5s, 228]
                       [10s, 228]
                       [20s, 228]
                       [30s, 228]

when I try to chart using chart sum(desiredValue) by desiredBucket

I understand why this is happening but I can't seem to find a way to get Splunk to identify my desired associations. Help?

[dwestbrook]

@aweitzman - your comment helped. Basically, I had to extract [2s,189] [5s,23] [10s,13] [20s,3] [30s,0] and then use makemv to get the charting to behave as I needed. Before, I was simply doing multiple matches from a single rex. Post that as an answer instead of a comment and I'll accept your answer.

[aweitzman]

Glad I was able to help. Converted my comment to an answer.

[aweitzman · Accepted solution]

So this works for me:

| gentimes start=-1 
| eval aaa="[2s,189] [5s,23] [10s,13] [20s,3] [30s,0]" 
| makemv delim=" " aaa 
| mvexpand aaa 
| rex field=aaa "\[(?<desiredBucket>.*),(?<desiredValue>.*)\]" 
| chart sum(desiredValue) by desiredBucket

In other words, your chart command looks like it ought to work for you. Are you sure your values are properly associated with their buckets?