Splunk Search

Search Syntax graph: Two dimensional single measurement chart

Explorer

Sorry to bother everyone with what may end up being a very simple question but I've been pulling out my hair trying to figure out the syntax on this.

Suppose each event has two fields: ID and Action

ID,Action

1,Inject

1,Inject

1,Retrieve

2,Serve

3,Inject

....and so on.

I would like to know how to create a graph that looks a little like this shoddily made paint image.

Obviously the colors, positions, and labels don't matter I'm just interested in the syntax that can create a similar graph so I can tweak it from there.

Any help whatsoever would be greatly appreciated,

JTG

Tags (3)
0 Karma
1 Solution

Communicator

Hello brother,

use the below search command and the chart formatting options,

| chart count over ID by Action

as a result of this you will get a table view, you have to do the charting stuff manually and save it.

go to the chart formatting options,
Chart type is BAR

then you have to select stacked mode

Stack mode is 100% STACKED

happy splunking brother,

if this helped you dont forget to vote,

yours,

eashwar raghunathan

View solution in original post

Communicator

Hello brother,

use the below search command and the chart formatting options,

| chart count over ID by Action

as a result of this you will get a table view, you have to do the charting stuff manually and save it.

go to the chart formatting options,
Chart type is BAR

then you have to select stacked mode

Stack mode is 100% STACKED

happy splunking brother,

if this helped you dont forget to vote,

yours,

eashwar raghunathan

View solution in original post

Explorer

That did it! Thanks a lot

0 Karma