Splunk Search

Query Modification

_gkollias
Builder

I have a search that tables project name, the group it belongs to, and the total count of deployment types:

index=eis_continuous_integration sourcetype=eisci
|search Group="EG"
| bucket span=1d _time as Date
| eval Date = strftime(Date, "%m/%d/%Y")
| stats count as total_deployment_count by SRCProject, Group

It's a nice table and all, but I'd like to create a column chart that displays the different project names on the x-axis, the group it belongs to on the left hand side (not just "Group", but "EG", etc.), and the total deployment count as the y-axis.

How can I modify this search so I get these results in a dashboard panel?

Thank You

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Hi,

Your query looks a bit odd. The search Group="EG" condition could be moved to before the first pipe. You do some calculations on time/date, but never use them...

Without having any sample data, it's bit hard to see what you want to do, but perhaps you are looking for something like this;

index=eis_continuous_integration sourcetype=eisci
| chart count as total_deployment_count over SRCProject by Group

/K

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

Hi,

Your query looks a bit odd. The search Group="EG" condition could be moved to before the first pipe. You do some calculations on time/date, but never use them...

Without having any sample data, it's bit hard to see what you want to do, but perhaps you are looking for something like this;

index=eis_continuous_integration sourcetype=eisci
| chart count as total_deployment_count over SRCProject by Group

/K

0 Karma

_gkollias
Builder

Thanks for pointing that out. I used a search I previously used and never removed it :slightly_smiling_face:

That search helped, I really appreciate it!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...