Splunk Search

How to get multiple legends on x-axis?

paritoshs24
Path Finder

Hi Team,

Following is my data:

SS TT DT DA LT LA TO TA
a xxx 4 3 2 3 7 6
a yyy 2 2 2 3 4 5
b xxx 1 1 1 1 3 3
b yyy 1 1 1 1 1 1

 

following is the graph i can  populate in excel

paritoshs24_0-1652390456218.png

Following is the graph I was able  to populate in splunk

paritoshs24_1-1652390498027.png

 

 

 

 

 

My problem is I can "SS" written in the Splunk graph, also I can see "a" "b" written in the graph....but along from these i also need  "xxx"  "yyy" to appear as legend under all 4 graphs.
how can we do that? 

MY QUERY FOR DATA 
|stats sum(* ) by SS,TT
|foreach sum* [eval <<FIELD>> = round(('<<FIELD>>' * 1000),2) ]
|rename sum(*) as *
|stats values(*) by SS,TT
|rename values(*) as *
|table SS,TT,DT,DA,LT,LA,TO,TA

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT

View solution in original post

paritoshs24
Path Finder

Thanks a  lot !! You saved me  so much of Energy !! 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...