Splunk Search

How to modify my search to get result shown in a visualization chart?

surekhasplunk
Communicator

Am using this search

index=level3 host=Test | chart count over "Opened" by "Assignment group"

I am getting the desired result in statistics but not in visualization.
Please help.
Am not able to post any pictures so pls mail me i will reply back.

Tags (2)
0 Karma

sundareshr
Legend

Which visualization are you using? Have you set it to one of the chart types (bar, line, area) or a format that is compatible with the data?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please try..capital over and by.

index=level3 host=Test | chart count OVER "Opened" BY "Assignment group"

your mail id is not available on your profile ..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...