Splunk Search

How to plot timechart graph with count of fruits for each door?

venky1544
Builder

Time door Fruit Count
11/11/2022 04:36:07 112 APPLE 14
11/11/2022 04:10:00 111 PEAR 8
11/11/2022 03:01:02 111 PEAR 119
11/11/2022 02:41:49 111 PEAR 82
10/11/2022 21:41:18 111 PEAR 26
10/11/2022 18:11:16 111 PEAR 12
10/11/2022 01:36:15 111 Orange 5

i want to plot timechart graph with count of fruits for each door 

Labels (1)
0 Karma

venky1544
Builder

Hi ITWhisperer

thanks for the answer but i'm having problem in visualization as i want to split by  door i'm trying to use trellis but not working  as when i try to split by door using trellis i can't see the fruits in the graph

 

|makeresults |eval date="11/11/2022 04:36:07", door="112", fruit="APPLE", num="14"
|append [|makeresults |eval date="11/11/2022 04:10:00", door="111", fruit="PEAR", num="8"]
|append [|makeresults |eval date="11/11/2022 03:01:02", door="111", fruit="PEAR", num="119"]
|append [|makeresults |eval date="11/11/2022 02:41:49", door="111", fruit="PEAR", num="82"]
|append [|makeresults |eval date="10/11/2022 21:41:18", door="111", fruit="PEAR", num="26"]
|append [|makeresults |eval date="10/11/2022 18:11:16", door="111", fruit="PEAR", num="12"]
|append [|makeresults |eval date="10/11/2022 01:36:15", door="111", fruit="Orange", num="5"]
| bin span=1h _time | stats sum(num) as count by _time door fruit

venky1544_0-1669120571224.png

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

timechart only allows one other dimension apart from time, so try something like this

| bin span=1h _time
| stats sum(count) as count by _time door fruit
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...