Splunk Search

Timechart group by 2 fields

ReddySk
Explorer

Hello,

I am trying to find a solution to paint a timechart grouped by 2 fields.

I have a stats table like:

Time                  Group    Status     Count
2018-12-18 21:00:00   Group1   Success    15
2018-12-18 21:00:00   Group1   Failure    5
2018-12-18 21:00:00   Group2   Success    1544
2018-12-18 21:00:00   Group2   Failure    44
2018-12-18 22:00:00   Group1   Success    112
2018-12-18 22:00:00   Group1   Failure    4
2018-12-18 22:00:00   Group2   Success    1544
2018-12-18 22:00:00   Group2   Failure    12

I need to get

Time                  Group1 - Success    Group1 - Failure    Group2 - Sucess    Group2 - Failure
2018-12-18 21:00:00                 15                   5               1544                  44
2018-12-18 22:00:00                112                   4               1544                  12

I wanted to use this what I somehow understood from another articles

index="sbox" type=transaction | bin _time | eval groupStatus=Group+" - "+Status |  timechart count as total by groupStatus

but it is giving me...

Time                      NULL
2018-12-18 21:00:00       1608
2018-12-18 22:00:00       1672

Can you please advise the right syntax?

Thank you,
Rudo

0 Karma
1 Solution

renjith_nair
Legend

@ReddySk,

Try

"Your current search"
| eval groupstatus=Group." - ".Status
| chart values(Count) as Count over Time  by groupstatus
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@ReddySk,

Try

"Your current search"
| eval groupstatus=Group." - ".Status
| chart values(Count) as Count over Time  by groupstatus
---
What goes around comes around. If it helps, hit it with Karma 🙂

ReddySk
Explorer

Thank you. It helped.

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...