Splunk Search

How to get multiple legends on x-axis?

paritoshs24
Path Finder

Hi Team,

Following is my data:

SS TT DT DA LT LA TO TA
a xxx 4 3 2 3 7 6
a yyy 2 2 2 3 4 5
b xxx 1 1 1 1 3 3
b yyy 1 1 1 1 1 1

 

following is the graph i can  populate in excel

paritoshs24_0-1652390456218.png

Following is the graph I was able  to populate in splunk

paritoshs24_1-1652390498027.png

 

 

 

 

 

My problem is I can "SS" written in the Splunk graph, also I can see "a" "b" written in the graph....but along from these i also need  "xxx"  "yyy" to appear as legend under all 4 graphs.
how can we do that? 

MY QUERY FOR DATA 
|stats sum(* ) by SS,TT
|foreach sum* [eval <<FIELD>> = round(('<<FIELD>>' * 1000),2) ]
|rename sum(*) as *
|stats values(*) by SS,TT
|rename values(*) as *
|table SS,TT,DT,DA,LT,LA,TO,TA

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT

View solution in original post

paritoshs24
Path Finder

Thanks a  lot !! You saved me  so much of Energy !! 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Meet the .conf26 AI Agent Buildathon Winners

At the .conf26 AI Agent Buildathon, Splunk users turned their operational expertise into working AI agents ...

Trusted Autonomy in the SOC: A Maturity Journey

AI is compressing attacker timelines and pushing SOC teams beyond human capacity thresholds. The next SOC ...

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...