Splunk Search

How to represent data in piechart/Linechart which I received by using REST API

rupesh_patil20
Path Finder

My data after search has following columns along with the other columns as below

MLS_Number Count
1129078 1
1248955 1
1290591 2
1379041 1
2035500 3
2146693 1
2177466 4
2208748 1
2362548 1
3040705 1
3047234 3
4638653 2

so, on Y-axis it will show Count as 1, 2, 3 and 4
on X- axis I want count of MLS_Number, with respect to Count 1, 2,3,4

eg. here there are 7 records for the count = 1
similarly 2 records for Count = 2 in a such way .. i want to display the data.
Please help me with this..
Thanks Buddy...!!

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search generating MLS_Number Count as shown in ques | stats count(MLS_Number) as MLSNumber by Count

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

your current search generating MLS_Number Count as shown in ques | stats count(MLS_Number) as MLSNumber by Count
0 Karma

rupesh_patil20
Path Finder

Hi Somesoni2,

I tried your query and I got the result but the problem arose now is it is giving me repetitive count, for example here there are 7 records for the count = 1, but in the result the count shown as 98550. As I am using REST API for input.. so may be it updates the data continuously.
Can you help me with time stamp, like how I can add it in search to get the exact data.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...