Splunk Search

How to modify my search to get result shown in a visualization chart?

surekhasplunk
Communicator

Am using this search

index=level3 host=Test | chart count over "Opened" by "Assignment group"

I am getting the desired result in statistics but not in visualization.
Please help.
Am not able to post any pictures so pls mail me i will reply back.

Tags (2)
0 Karma

sundareshr
Legend

Which visualization are you using? Have you set it to one of the chart types (bar, line, area) or a format that is compatible with the data?

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please try..capital over and by.

index=level3 host=Test | chart count OVER "Opened" BY "Assignment group"

your mail id is not available on your profile ..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...