Splunk Search

How to display multiple fields on the x-axis of a chart?

ID_SplunkUser
Path Finder

Displaying the multiple fields on X-axis of chart. Below is my current search:

index=home | eval Value=substr(Name,-1) |stats count(eval(Value=="A")) AS AValue,count(eval(Status=="B")) AS BValue,count(eval(Value=="C")) AS CValue| Eval DValue= AValue-BValue | chart max(Complete),max(Received),max(Acknowledged),max(Missing)

I want to display a Column chart having AValue, BValue, CValue & DValue on the X-Axis displaying the count of each. Right now this chart command is not working for me.

Thanks

0 Karma

somesoni2
Revered Legend

Try like this

 index=home | eval Value=substr(Name,-1) | eval temp=1 | chart count over temp by Value | eval Missing=A-B | rename A as Received B as Complete C as Acknowledged | table Complete Received Acknowledged Missing
0 Karma

sundareshr
Legend

Try this

index=home 
| eval Value=substr(Name,-1) 
| eval status=case(Value="A", "AValue", Status="B", "BValue", Value="C", "CValue", 1=1, "Missing")
| stats count by status
| eval DValue=AValue-BValue
0 Karma

ID_SplunkUser
Path Finder

I tried this, but after stats command it doesn't show the Missing count in it.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...