Splunk Search

Multiple graphs in line chart

patilsh
Explorer

Hello All,

I have a data as below :
Where for every callId there are list of values in next column. So I have some 10 callId and for every callId and I have list of values in column 2

alt text

Now I want to plot a line chart , for the values in column 2 such that every callId corresponds to a separate line in visualization.

Can someone please tell me how can we achieve this.

Regards
Shailendra Patil

Tags (1)
0 Karma

somesoni2
Revered Legend

I think you current search ends like this ..| stats list(entryData.LevelIn) by callId. Instead just use like this

your search before the stats | stats avg(entryData.LevelIn)  as AvgLevelIn by callId
0 Karma

patilsh
Explorer

index="alpha_all_careport_event" userId="90925fcb-4543-4d9e-87f4-51ab9b4b7cd8"|stats list(eventData.txLevelIn) by callId|rename "list(eventData.txLevelIn)" AS Levelin|mvexpand Levelin|streamstats count AS serial BY callId|chart avg(Levelin) OVER serial BY callId

This is how it ends , its shows as 352 events , but in table i can see 100 only for each

0 Karma

woodcock
Esteemed Legend

Add this to the bottom of your existing search:

... | rename "list(EventData.txt.Levelin)" AS Levelin
| mvexpand Levelin
| streamstats count AS serial BY callId
| chart avg(Levelin) OVER serial BY callId
0 Karma

patilsh
Explorer

Hey, Thanks for the help,

But i can just see 100 events for each ID here ?

Is that a limit ?

0 Karma

woodcock
Esteemed Legend

There is a limit on list (and values) but I think it is 1000, not 100.

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...