Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Search Syntax graph: Two dimensional single ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry to bother everyone with what may end up being a very simple question but I've been pulling out my hair trying to figure out the syntax on this.
Suppose each event has two fields: ID and Action
ID,Action
1,Inject
1,Inject
1,Retrieve
2,Serve
3,Inject
....and so on.
I would like to know how to create a graph that looks a little like this shoddily made paint image.
Obviously the colors, positions, and labels don't matter I'm just interested in the syntax that can create a similar graph so I can tweak it from there.
Any help whatsoever would be greatly appreciated,
JTG
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello brother,
use the below search command and the chart formatting options,
| chart count over ID by Action
as a result of this you will get a table view, you have to do the charting stuff manually and save it.
go to the chart formatting options,
Chart type is BAR
then you have to select stacked mode
Stack mode is 100% STACKED
happy splunking brother,
if this helped you dont forget to vote,
yours,
eashwar raghunathan
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello brother,
use the below search command and the chart formatting options,
| chart count over ID by Action
as a result of this you will get a table view, you have to do the charting stuff manually and save it.
go to the chart formatting options,
Chart type is BAR
then you have to select stacked mode
Stack mode is 100% STACKED
happy splunking brother,
if this helped you dont forget to vote,
yours,
eashwar raghunathan
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That did it! Thanks a lot
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
