Splunk Search

## Unidimensional histogram (chart without "by" clause)

Contributor

I have difficulties to create a simple, unidimentional histogram. Suppose you have a log similar to this:

```host=host1 sent=1 received=2
```

I'd like to create a simple histogram displaying the total amount of "sent" and "received", no matter what host.
The following search command doesn't give expected results because I end up with a single column with the value of 6 ("sum(received)") :

```host=host* | chart sum(sent), sum(received)
```

What's wrong with my search?

Edit
Added pictures to clarify my question

Table view (correct):

Chart view (not correct ? or at least not what I would expect):

Tags (2)
1 Solution
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

`````` | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes
``````
SplunkTrust

AH! OK. In a previous answer, by "columns" you meant columns in a chart and I thought you meant columns as in a table. So we were both right.

Indeed, the chart here is misinterpreting what you want. In a chart each row is a data point, the first value in that row is the main x-axis value, and any subsequent values are taken as the one or more series to be charted.

The simplest way to fix this is to tack on a transpose command to give chart data it can interpret correctly:

`````` | chart sum(sent), sum(received) | transpose | rename column as type "row 1" as bytes
``````
Contributor

Thanks both for the explanation and the solution

Communicator

Here's a search, loosely based on documentation:

``````host=host* | chart sum(sent) AS sumsent, sum(received) AS sumreceived by _time | eval s1="Sent Received" | makemv s1 | mvexpand s1 | eval yval=case(s1=="Sent",sumsent,s1=="Received",sumreceived) | chart sum(yval) AS Sum by s1
``````