Splunk Search

How to edit my search to display a distribution graph grouped by a field?

kualo
Explorer
[2016-xx-xx-xx:xx:xx:xxxx] modelName=model1, modelScore=10
[2016-xx-xx-xx:xx:xx:xxxx] modelName=model2, modelScore=100
[2016-xx-xx-xx:xx:xx:xxxx] modelName=model3, modelScore=50

My log looks something like above

 some search| stats count by modelScore | sort modelScore

I have the above search to show the distribution of the modelScore using bar visualization.alt text

However, I would like to show modelScore for each modelName in the same bar graph in different colors.
Is there any way I can do that?
Thanks.

1 Solution

gokadroid
Motivator

can you try this please based on whichever way you want to chart:

Keeping modelName on x axis

some search| chart  count over modelName by modelScore

OR
Keeping modelScore on x axis

some search| chart  count over modelScore by modelName

View solution in original post

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

You probably want to use some search| stats count by modelScore | makecontinuous modelScore as to add any potentially empty buckets/bins.

0 Karma

gokadroid
Motivator

can you try this please based on whichever way you want to chart:

Keeping modelName on x axis

some search| chart  count over modelName by modelScore

OR
Keeping modelScore on x axis

some search| chart  count over modelScore by modelName
0 Karma

kualo
Explorer

Thanks! I works perfectly.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...