Splunk Search

How to display multiple fields on the x-axis of a chart?

Path Finder

Displaying the multiple fields on X-axis of chart. Below is my current search:

index=home | eval Value=substr(Name,-1) |stats count(eval(Value=="A")) AS AValue,count(eval(Status=="B")) AS BValue,count(eval(Value=="C")) AS CValue| Eval DValue= AValue-BValue | chart max(Complete),max(Received),max(Acknowledged),max(Missing)

I want to display a Column chart having AValue, BValue, CValue & DValue on the X-Axis displaying the count of each. Right now this chart command is not working for me.

Thanks

0 Karma

SplunkTrust
SplunkTrust

Try like this

 index=home | eval Value=substr(Name,-1) | eval temp=1 | chart count over temp by Value | eval Missing=A-B | rename A as Received B as Complete C as Acknowledged | table Complete Received Acknowledged Missing
0 Karma

Legend

Try this

index=home 
| eval Value=substr(Name,-1) 
| eval status=case(Value="A", "AValue", Status="B", "BValue", Value="C", "CValue", 1=1, "Missing")
| stats count by status
| eval DValue=AValue-BValue
0 Karma

Path Finder

I tried this, but after stats command it doesn't show the Missing count in it.

0 Karma