Splunk Search

How to plot username (non-numeric) value on the y-axis on a scatter chart?

Venkat_16
Contributor

I have a log in the following format:

username=nan time=09:00 operation=login
username=ver time=10:00 opertiaon=logout
username=ves time=09:00 operation=login
username=ves time=10:00 opetaion=logout

I need the output in the following format as a scatter plot. I am able to make it in a table, but not in scatter chart.
alt text

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Hey Venkat,

Why not try something like this?

... | timechart count(eval(operation="login")) as logins, count(eval(operation="logout")) as logouts by username

Then chose a bar/column chart visualization?

0 Karma

Venkat_16
Contributor

Hi aljohnson_splunk,
Thanks for the response, but we have more than 30+ users and 5 to 6 operations , in that case the following solution gives
"These results may be truncated. Your search generated too much data for the current visualization configuration." notifaction

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Change the time range and the span, e.g.

... earliest=-2w | timechart span=1d count(eval(operation="operation1")) as operation1 .... and so on
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...