Splunk Search

How to create aa chart using xyseries command syntax?

Ahmedkhalil
Path Finder

Dears,

i would like to create chart that contain two different x axis and one y axis using xyseries command
but i couldn't locate the correct syntax the guide say that correct synatx as below but it's not working for me
xyseries x-fieldname y-name-field y-data-field
ex: xyseries x-host x-ipaddress y-name-sourcetype y-data-value

any help please!
thanks in adavnce

Labels (1)
Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

It will be a 3 step process, (xyseries will give data with 2 columns x and y).

Step 1) Concatenate your x-host and x-ipaddress into 1 field, say temp
Step 2) Run your xyseries with temp y-name-sourcetype y-data-value.
Step 3) Use Rex/eval-split to separate temp as x=host and x-ipaddress

Sample:

index=_internal | stats count by sourcetype source component | eval temp=source."#".component | xyseries temp sourcetype count
| rex field=temp "(?<source>.*)#(?<component>.*)" | fields - temp

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

It will be a 3 step process, (xyseries will give data with 2 columns x and y).

Step 1) Concatenate your x-host and x-ipaddress into 1 field, say temp
Step 2) Run your xyseries with temp y-name-sourcetype y-data-value.
Step 3) Use Rex/eval-split to separate temp as x=host and x-ipaddress

Sample:

index=_internal | stats count by sourcetype source component | eval temp=source."#".component | xyseries temp sourcetype count
| rex field=temp "(?<source>.*)#(?<component>.*)" | fields - temp

tarun_l
Engager

Thanks for your solution - it helped.

0 Karma

Ahmedkhalil
Path Finder

many thanks for your answer

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...