Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Search Syntax graph: Two dimensional single meas...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry to bother everyone with what may end up being a very simple question but I've been pulling out my hair trying to figure out the syntax on this.
Suppose each event has two fields: ID and Action
ID,Action
1,Inject
1,Inject
1,Retrieve
2,Serve
3,Inject
....and so on.
I would like to know how to create a graph that looks a little like this shoddily made paint image.
Obviously the colors, positions, and labels don't matter I'm just interested in the syntax that can create a similar graph so I can tweak it from there.
Any help whatsoever would be greatly appreciated,
JTG
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello brother,
use the below search command and the chart formatting options,
| chart count over ID by Action
as a result of this you will get a table view, you have to do the charting stuff manually and save it.
go to the chart formatting options,
Chart type is BAR
then you have to select stacked mode
Stack mode is 100% STACKED
happy splunking brother,
if this helped you dont forget to vote,
yours,
eashwar raghunathan
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello brother,
use the below search command and the chart formatting options,
| chart count over ID by Action
as a result of this you will get a table view, you have to do the charting stuff manually and save it.
go to the chart formatting options,
Chart type is BAR
then you have to select stacked mode
Stack mode is 100% STACKED
happy splunking brother,
if this helped you dont forget to vote,
yours,
eashwar raghunathan
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That did it! Thanks a lot
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
