Splunk Search

Why is multiple stats count eval not working?

onegame999
Explorer
SEARCH | stats count(eval(Status="1")) as Assigned count(eval(Status="2")) as In_progress, count(eval(Status="3")) as Pending. count(eval(Status="4")) as Resolved count(eval(Status="5")) as Closed 

I get nice table with all columns and headers but when I use column chart the first one Assigned is not on the legend and its seen as the x axis title

0 Karma

renjith_nair
Legend

@onegame999 ,

Thats because, your search does not have an x & y axis for a chart.

Try adding this to your search

your current search
| transpose column_name="Status"| rename "row 1" as count
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...