Splunk Search

How to get a Line Chart with 3 Split by Clauses?

mstark31
Path Finder

I have a set of lab samples that have a Percent value measured in 3 different locations across the sample, identified as A, B, and C. Each sample is also associated with a different style.

My end goal is to have a line chart with SampleID on the x-axis and Pct on the y-axis with a set 3 different data series for each of the locations A, B, and C for each style. (So Style1PctA, Style1PctB, Style1PctC, Style2PctA, Style2PctB, Style2PctC,...)
Then, I want to use Trellis view to separate by Style, so I'd have a graph with the series for A, B, and C for each Style.

My search is as follows:

| stats avg(Pct) as Pct by SampleID, Location, Style

which of course gives me a table that contains the following fields: SampleID, Location, Style, Pct.
This results in a graph with 3 series: Location, Style, and Pct, but Pct is the only one that shows up on the graph and there is no differentiation by Location or Style.
From there, I can Trellis by Style, but there is no differentiation by Location.

I know that I can accomplish this by doing a separate search (or using a token) to filter by Style before graphing, but then I have to hard-code each of my Styles into either an input on a dashboard, or a series of graphs.

| search Style=123
| stats avg(Pct) as Pct by SampleID, Location

Is there a better way to accomplish this?

mstark31
Path Finder

That second block of code should say chart on line 2 instead of stats

0 Karma

somesoni2
Revered Legend

GIve this a try

....| stats avg(Pct) as Pct by SampleID, Location, Style | eval Loc_Style=Location.":".Stype
| chart avg(Pct) over SampleID by Loc_Style
0 Karma

mstark31
Path Finder

Thank you. While this does work to get all the data series on a single chart, it does not work if I want to do a trellis view separating by Style.

Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...