Splunk Search

How to have multiple fields (non numeric) in x-axis on a bar chart?

th1agarajan
Path Finder

My Splunk Search is as follows

index="someindex" cf_space_name="somespace" msg.severity="*" | rex field=msg.message ".*METHOD:(?<method>.*),\sREQUEST_URI>.*),\sRESPONSE_CODE:(?<responseCode>.*),\sRESPONSE_TIME:(?<responseTime>.*)\sms" | stats count by msg.service,method, requestURI, responseCode | sort -count

Result Table

 

msg.servicemethodrequestURIresponseCodeCount
serviceAGET/v1/service/a200327
serviceBPOST/v1/service/b200164
serviceAPOST/v1/service/a200 91

 

Under Visualization, I am trying to change this as a bar chart.

I am getting all four fields on the x-axis. msg.service is mapped with count, and responseCode is mapped with responseCode. The other 2 fields are not visible since they are non-numeric fields. 

if I remove fields using the following I get the proper chart (just msg.service mapped with count)

my query | fields -responseCode, method, reqeustURI

But I need something like this on the x and y axis

x axisy axis
serviceA GET v1/service/a 200327
serviceB POST /v1/service/b 200164
serviceA POST/v1/service/a 200 91

 

How to achieve this?

 

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval request='msg.service'." ".method." ".requestURI." ".responseCode
| table request Count

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval request='msg.service'." ".method." ".requestURI." ".responseCode
| table request Count
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...