Splunk Search

How to get multiple legends on x-axis?

paritoshs24
Path Finder

Hi Team,

Following is my data:

SS TT DT DA LT LA TO TA
a xxx 4 3 2 3 7 6
a yyy 2 2 2 3 4 5
b xxx 1 1 1 1 3 3
b yyy 1 1 1 1 1 1

 

following is the graph i can  populate in excel

paritoshs24_0-1652390456218.png

Following is the graph I was able  to populate in splunk

paritoshs24_1-1652390498027.png

 

 

 

 

 

My problem is I can "SS" written in the Splunk graph, also I can see "a" "b" written in the graph....but along from these i also need  "xxx"  "yyy" to appear as legend under all 4 graphs.
how can we do that? 

MY QUERY FOR DATA 
|stats sum(* ) by SS,TT
|foreach sum* [eval <<FIELD>> = round(('<<FIELD>>' * 1000),2) ]
|rename sum(*) as *
|stats values(*) by SS,TT
|rename values(*) as *
|table SS,TT,DT,DA,LT,LA,TO,TA

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT

View solution in original post

paritoshs24
Path Finder

Thanks a  lot !! You saved me  so much of Energy !! :slightly_smiling_face:

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...