Splunk Search

Trying to change X axis description in a chart

wye054
New Member

Hi ,

i am using this query to get the daily transaction for every hour for a day.

sourcetype="*Leg324.log" tid|rex field=_raw "\stid((?\d+)"|dedup tid |eval status = if(transaction == 200, "OK", "Error")|stats count(tid) AS transaction_per_hour BY date_hour, date_mday | chart avg(transaction_per_hour) By date_hour

in X axis i am getting avg(transaction_per_hour) ,can anybody help me to get transaction_per_hour instead of the earlier one .

Tags (1)
0 Karma

somesoni2
Revered Legend

Use this

sourcetype="*Leg324.log" tid|rex field=_raw "stid((?<tid>d+)"|dedup tid |eval status = if(transaction == 200, "OK", "Error")|stats count(tid) AS transaction_per_hour BY date_hour, date_mday | chart avg(transaction_per_hour) as transaction_per_hour By date_hour 
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...