Splunk Search

Why is multiple stats count eval not working?

onegame999
Explorer
SEARCH | stats count(eval(Status="1")) as Assigned count(eval(Status="2")) as In_progress, count(eval(Status="3")) as Pending. count(eval(Status="4")) as Resolved count(eval(Status="5")) as Closed 

I get nice table with all columns and headers but when I use column chart the first one Assigned is not on the legend and its seen as the x axis title

0 Karma

renjith_nair
Legend

@onegame999 ,

Thats because, your search does not have an x & y axis for a chart.

Try adding this to your search

your current search
| transpose column_name="Status"| rename "row 1" as count
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...