Splunk Search

Timechart group by 2 fields

ReddySk
Engager

Hello,

I am trying to find a solution to paint a timechart grouped by 2 fields.

I have a stats table like:

Time                  Group    Status     Count
2018-12-18 21:00:00   Group1   Success    15
2018-12-18 21:00:00   Group1   Failure    5
2018-12-18 21:00:00   Group2   Success    1544
2018-12-18 21:00:00   Group2   Failure    44
2018-12-18 22:00:00   Group1   Success    112
2018-12-18 22:00:00   Group1   Failure    4
2018-12-18 22:00:00   Group2   Success    1544
2018-12-18 22:00:00   Group2   Failure    12

I need to get

Time                  Group1 - Success    Group1 - Failure    Group2 - Sucess    Group2 - Failure
2018-12-18 21:00:00                 15                   5               1544                  44
2018-12-18 22:00:00                112                   4               1544                  12

I wanted to use this what I somehow understood from another articles

index="sbox" type=transaction | bin _time | eval groupStatus=Group+" - "+Status |  timechart count as total by groupStatus

but it is giving me...

Time                      NULL
2018-12-18 21:00:00       1608
2018-12-18 22:00:00       1672

Can you please advise the right syntax?

Thank you,
Rudo

0 Karma
1 Solution

renjith_nair
Legend

@ReddySk,

Try

"Your current search"
| eval groupstatus=Group." - ".Status
| chart values(Count) as Count over Time  by groupstatus
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@ReddySk,

Try

"Your current search"
| eval groupstatus=Group." - ".Status
| chart values(Count) as Count over Time  by groupstatus
---
What goes around comes around. If it helps, hit it with Karma 🙂

ReddySk
Engager

Thank you. It helped.

0 Karma
Get Updates on the Splunk Community!

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

❄️ Welcome the new year with our January lineup of Community Office Hours, Tech Talks, and Webinars! 🎉 ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...