Splunk Search

Why is multiple stats count eval not working?

onegame999
Explorer
SEARCH | stats count(eval(Status="1")) as Assigned count(eval(Status="2")) as In_progress, count(eval(Status="3")) as Pending. count(eval(Status="4")) as Resolved count(eval(Status="5")) as Closed 

I get nice table with all columns and headers but when I use column chart the first one Assigned is not on the legend and its seen as the x axis title

0 Karma

renjith_nair
Legend

@onegame999 ,

Thats because, your search does not have an x & y axis for a chart.

Try adding this to your search

your current search
| transpose column_name="Status"| rename "row 1" as count
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...