Splunk Search

How to edit my search to display a distribution graph grouped by a field?

kualo
Explorer
[2016-xx-xx-xx:xx:xx:xxxx] modelName=model1, modelScore=10
[2016-xx-xx-xx:xx:xx:xxxx] modelName=model2, modelScore=100
[2016-xx-xx-xx:xx:xx:xxxx] modelName=model3, modelScore=50

My log looks something like above

 some search| stats count by modelScore | sort modelScore

I have the above search to show the distribution of the modelScore using bar visualization.alt text

However, I would like to show modelScore for each modelName in the same bar graph in different colors.
Is there any way I can do that?
Thanks.

1 Solution

gokadroid
Motivator

can you try this please based on whichever way you want to chart:

Keeping modelName on x axis

some search| chart  count over modelName by modelScore

OR
Keeping modelScore on x axis

some search| chart  count over modelScore by modelName

View solution in original post

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

You probably want to use some search| stats count by modelScore | makecontinuous modelScore as to add any potentially empty buckets/bins.

0 Karma

gokadroid
Motivator

can you try this please based on whichever way you want to chart:

Keeping modelName on x axis

some search| chart  count over modelName by modelScore

OR
Keeping modelScore on x axis

some search| chart  count over modelScore by modelName
0 Karma

kualo
Explorer

Thanks! I works perfectly.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...