Splunk Search

How to create Multi-line linechart?

fishmong3r0
Loves-to-Learn Lots

Guys, I have a very simple output that looks like:

week car total broken
31 Volvo 100 20
31 Hyundai 130 10
31 Ford 240 44
32 Volvo 98 15
32 Hyundai 143 7
32 Ford 238 52

 

What I need is a linechart where X-axis is week number and there are 2 lines per product - total and broken.

This works for one, but not sure how to include the other:

 

 

query | chart values(broken) by week, car

 

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart values(total) as total values(broken) as broken by week car
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...