Splunk Search

Unidimensional histogram (chart without "by" clause)

yoho
Contributor

I have difficulties to create a simple, unidimentional histogram. Suppose you have a log similar to this:

host=host1 sent=1 received=2
host=host2 sent=3 received=3
host=host1 sent=18 received=1

I'd like to create a simple histogram displaying the total amount of "sent" and "received", no matter what host.
The following search command doesn't give expected results because I end up with a single column with the value of 6 ("sum(received)") :

host=host* | chart sum(sent), sum(received)

What's wrong with my search?

Edit
Added pictures to clarify my question

Table view (correct):
alt text

Chart view (not correct ? or at least not what I would expect):
alt text

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

 | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes

View solution in original post

sideview
SplunkTrust
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

 | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes

yoho
Contributor

Thanks both for the explanation and the solution

0 Karma

srioux
Communicator

Here's a search, loosely based on documentation:

host=host* | chart sum(sent) AS sumsent, sum(received) AS sumreceived by _time | eval s1="Sent Received" | makemv s1 | mvexpand s1 | eval yval=case(s1=="Sent",sumsent,s1=="Received",sumreceived) | chart sum(yval) AS Sum by s1

Documentation link:

http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/Chartmultipledataseries

yoho
Contributor

Works perfect. I would have thought there was a simpler way though.

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...