Splunk Search

How to get multiple legends on x-axis?

paritoshs24
Path Finder

Hi Team,

Following is my data:

SS TT DT DA LT LA TO TA
a xxx 4 3 2 3 7 6
a yyy 2 2 2 3 4 5
b xxx 1 1 1 1 3 3
b yyy 1 1 1 1 1 1

 

following is the graph i can  populate in excel

paritoshs24_0-1652390456218.png

Following is the graph I was able  to populate in splunk

paritoshs24_1-1652390498027.png

 

 

 

 

 

My problem is I can "SS" written in the Splunk graph, also I can see "a" "b" written in the graph....but along from these i also need  "xxx"  "yyy" to appear as legend under all 4 graphs.
how can we do that? 

MY QUERY FOR DATA 
|stats sum(* ) by SS,TT
|foreach sum* [eval <<FIELD>> = round(('<<FIELD>>' * 1000),2) ]
|rename sum(*) as *
|stats values(*) by SS,TT
|rename values(*) as *
|table SS,TT,DT,DA,LT,LA,TO,TA

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT

View solution in original post

paritoshs24
Path Finder

Thanks a  lot !! You saved me  so much of Energy !! 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...