Splunk Search
Highlighted

how to show three values in label in visualization of splunk

New Member

in my chart I am showing three variable values using xyseries command.
But looking at bar chart we can see only two values in label, other value in legend.
I need to show three values in Label, not in legend or variation in colors.

Please provide solution.

Tags (4)
0 Karma
Highlighted

Re: how to show three values in label in visualization of splunk

Super Champion

can you provide syntax/current visualization?

0 Karma
Highlighted

Re: how to show three values in label in visualization of splunk

New Member

index.foo host="foo" |.... eval foo...| xyseries servicefoo hostname count.....
In this above query, I can see two field values in bar chart (labels)..look like
1.Servicefoo : value
2. host
name: count's value & Host_name are showing in legend.

But I need all three value with field name in label while pointing the specific bar in bar chart. its should be like
1. Servicefoo: value,
2. count : value,
3.host
name:value.

how to come up with above three value in label in bar chart.

0 Karma
Highlighted

Re: how to show three values in label in visualization of splunk

Legend

Would it be possible for you to provide sample values for the three fields i.e.

servicefoo hostname count




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: how to show three values in label in visualization of splunk

New Member

Is it possible to get answer for this?

0 Karma
Highlighted

Re: how to show three values in label in visualization of splunk

Super Champion

try | xyseries service_foo host_name value

the last field in an xyseries is supposed to be the value being charted.
If that doesn't work, we might need more information. what data looks like before and after the xyseries. that command is finicky.

0 Karma
Highlighted

Re: how to show three values in label in visualization of splunk

New Member

if we need to show 4 or more value in lable means, how can I?

this is for host cpu utilization. Need to show Process %, host name,application running and counts, time.

0 Karma
Highlighted

Re: how to show three values in label in visualization of splunk

New Member

this is for host cpu utilization. Need to show Process %, host name,application running and counts, time, while placing the pointer in bar chart

0 Karma
Highlighted

Re: how to show three values in label in visualization of splunk

SplunkTrust
SplunkTrust

You can merge two fields into 1 using string concatenation in some and use that field for charting so that the label of concatenated field show 2 label values. Need full, actual search to give more accurate suggestions.

0 Karma
Highlighted

Re: how to show three values in label in visualization of splunk

New Member

how to show five values individual in label in visualization of splunk

0 Karma