Splunk Search

How to make X axis display the name of each field?

New Member

I have the following query:

index=msahc sourcetype=msahc_raw | rex "(?<json_field>{[^}]+})" | mvexpand json_field | spath input=json_field | search ACT | eval DateTime=_time | convert timeformat="%x" ctime(DateTime) | bucket DateTime span=1d | rename "IDM Access" as "IDM_Access", "FACTS Database Access" as "FACTS_Database_Access" | table IDM_Access | chart var(Field="IDM_Access") as Fields count(eval(IDM_Access=="False")) as False count(eval(IDM_Access=="True")) as True | append [search index=msahc sourcetype=msahc_raw | rex "(?<json_field>{[^}]+})" | mvexpand json_field | spath input=json_field | search ACT | eval DateTime=_time | convert timeformat="%x" ctime(DateTime) | bucket DateTime span=1d | rename "IDM Access" as "IDM_Access", "FACTS Database Access" as "FACTS_Database_Access" | table FACTS_Database_Access | chart var(Field="FACTS_Database_Access") as Fields count(eval(FACTS_Database_Access=="False")) as False count(eval(FACTS_Database_Access=="True")) as True]

That generates the following bar chart:

alt text

How can I get the bar chart to display the name of the "Fields", such as IDM_Access and FACTS_Database_Access?

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Give this a try. (Remove some dead code, merged both searches to get output with single search [no subsearch])

 index=msahc sourcetype=msahc_raw | rex "(?<json_field>{[^}]+})" | mvexpand json_field | spath input=json_field | search ACT | rename "IDM Access" as "IDM_Access", "FACTS Database Access" as "FACTS_Database_Access" | table IDM_Access FACTS_Database_Access | eval temp=1 | untable temp FieldName Value | chart count over FieldName by Value

View solution in original post

SplunkTrust
SplunkTrust

Give this a try. (Remove some dead code, merged both searches to get output with single search [no subsearch])

 index=msahc sourcetype=msahc_raw | rex "(?<json_field>{[^}]+})" | mvexpand json_field | spath input=json_field | search ACT | rename "IDM Access" as "IDM_Access", "FACTS Database Access" as "FACTS_Database_Access" | table IDM_Access FACTS_Database_Access | eval temp=1 | untable temp FieldName Value | chart count over FieldName by Value

View solution in original post

New Member

That worked perfectly! Thank you so much. I got the idea. Reducing redundancy makes the search way cleaner and way quicker.

0 Karma

SplunkTrust
SplunkTrust

@gcescatto,
Please ensure to format the splunk search/code using code sample formatter (button about the editing area labeled 101010 or by using Ctrl+K key after selecting the code.

0 Karma

New Member

I did, but nothing changed...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!