Splunk Search

How to merge multiple query in single output

Communicator

I have 5 query merged in single output. In statistics tab I am getting expected values. But in visualization tab when i am selecting bar chart for this table, first column value is displaying on x-axis as field name as x-axis label which should display as bar chart.
I have attached the screenshot. In this bottom table we can see 5 fields but in legend we can see only 4. Carecredit is showing as x-axis label.

Expected Result: All 5 field count in bar chart.

Note: I am getting correct result if I am using timechart rather than stats command.

0 Karma
1 Solution

Legend

@twh1... this exact scenario has been explained as a use case in Splunk documentation for transpose command. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transpose

Your data is missing first column to show aggregate fields like row 1 is Device and row 2 is Count. If possible you should refactor your five queries to get these two aggregate by and aggregate type fields. Otherwise you can just pipe the following and you should be able to pull the Count of various Devices

| transpose column_name="Count"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Communicator

I tried the below option and got the expected result.

.....| table _time CareCredit SYPI WKS Orange Samsung

0 Karma

Legend

@twh1... If you required time as one of the fields to be displayed you can actually use timechart or in stats add by _time clause. There is no need of an additional pipe with table. Based on your query seemed like you just needed 5 columns.

Anycase... glad you found your answer.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Esteemed Legend

Add this to the end of your search:

| eval PutXAxisLableTextHere=" "
| table PutXAxisLableTextHere *
0 Karma

Legend

@twh1... this exact scenario has been explained as a use case in Splunk documentation for transpose command. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transpose

Your data is missing first column to show aggregate fields like row 1 is Device and row 2 is Count. If possible you should refactor your five queries to get these two aggregate by and aggregate type fields. Otherwise you can just pipe the following and you should be able to pull the Count of various Devices

| transpose column_name="Count"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Super Champion

what is your timechart parameters?
You might be just doing a | stats count

but rather do "by"
| stats count by your_product_field

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!