Splunk Search

How to plot timechart graph with count of fruits for each door?

venky1544
Builder

Time door Fruit Count
11/11/2022 04:36:07 112 APPLE 14
11/11/2022 04:10:00 111 PEAR 8
11/11/2022 03:01:02 111 PEAR 119
11/11/2022 02:41:49 111 PEAR 82
10/11/2022 21:41:18 111 PEAR 26
10/11/2022 18:11:16 111 PEAR 12
10/11/2022 01:36:15 111 Orange 5

i want to plot timechart graph with count of fruits for each door 

Labels (1)
0 Karma

venky1544
Builder

Hi ITWhisperer

thanks for the answer but i'm having problem in visualization as i want to split by  door i'm trying to use trellis but not working  as when i try to split by door using trellis i can't see the fruits in the graph

 

|makeresults |eval date="11/11/2022 04:36:07", door="112", fruit="APPLE", num="14"
|append [|makeresults |eval date="11/11/2022 04:10:00", door="111", fruit="PEAR", num="8"]
|append [|makeresults |eval date="11/11/2022 03:01:02", door="111", fruit="PEAR", num="119"]
|append [|makeresults |eval date="11/11/2022 02:41:49", door="111", fruit="PEAR", num="82"]
|append [|makeresults |eval date="10/11/2022 21:41:18", door="111", fruit="PEAR", num="26"]
|append [|makeresults |eval date="10/11/2022 18:11:16", door="111", fruit="PEAR", num="12"]
|append [|makeresults |eval date="10/11/2022 01:36:15", door="111", fruit="Orange", num="5"]
| bin span=1h _time | stats sum(num) as count by _time door fruit

venky1544_0-1669120571224.png

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

timechart only allows one other dimension apart from time, so try something like this

| bin span=1h _time
| stats sum(count) as count by _time door fruit
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...