Splunk Search

How to chart with multiple values on legend

Dherom
New Member

I want to have different values ​​in the legend of a column and that the yaxis is a specific value of this legend.

sourcetype="securitycenter" asset=AMER_MS_SRV OR asset=EMEA_MS_SRV OR asset=APAC_MS_SRV 
|  rex field=asset "(?.*)_MS_SRV|"
|chart  eval(round(latest(crit),0)) as C by name |eval pos = case(name=="AMER","1",name=="EMEA","2",name=="APAC","3",name==name,"4") | sort pos| eval target=1 | table name, C, target

In this image I want to add Totips:totalvalue to legend and y-axis are "C".

alt text

Tags (3)
0 Karma

Dherom
New Member

I want add another value field 'totips' (on same char) and shown multiple values on same bar and this bar evaluated with 'C' field

thanks you for you answer

0 Karma

Dherom
New Member

i want other value to highligh linked.
Example

name:AMER
C:19
totips:890

but dont shown this bar(totips) in this panel. I did trellis values but i dont order by name, order by xaxys value(totips) and i want this.

0 Karma

tscroggins
Influencer

I don't think you can do this in a column chart. The tooltip HTML is created from a single series using the point value (X,Y) under the mouse pointer.

Are you open to custom solutions, or are you restricted to pure SimpleXML?

0 Karma

tscroggins
Influencer

Can you clarify your question? "Totips" isn't a field in your search. If you want to display e.g. "Totips: 19" in place of "C: 19" in the tooltip, then simply replace C with Totips in your search:

sourcetype="securitycenter" asset=AMER_MS_SRV OR asset=EMEA_MS_SRV OR asset=APAC_MS_SRV
| rex field=asset "(?.)_MS_SRV|"
|chart eval(round(latest(crit),0)) as **Totips
* by name |eval pos = case(name=="AMER","1",name=="EMEA","2",name=="APAC","3",name==name,"4") | sort pos| eval target=1 | table name, Totips, target

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...