Hi, Thanks for the help. I've tried using the search base and using the table command but the panel showed no results. However, I used the same method for panel1-panel2 instead and managed to get the results I wanted. | makeresults | eval result1=split("$panel1$",";") | mvexpand result1 | rex field=result1 "(?<column>\w+)=(?<value>.*)" | table column value   Thank you so much for the patience and effort in this. Deeply appreciated!  ... View more

Hi, Now I'm able to get the intended results in panel 3 by using stat sum. Thanks! However now there is issue with panel 1 and 2.    For panel 1 and 2,  I wan the visualization to be executed at the stats count portion (before merging) <query>index=_internal (earliest=$field1.earliest$ latest=$field1.latest$) | stats count by sourcetype | eventstats sum(count) as total | eval tmp=sourcetype."=".(-1 * count) | stats values(tmp) as tmp values(total) as total | eval count=mvjoin(tmp,";")</query>  How can I break this portion for the visualization only? Thanks ... View more

Hi, Noted on the * -1 portion.   Currently, Panel 3 has a results column like this: ABC=0.24 DEF=1.45 GHI=3.12 JKL=0.56 ABC=-2.1 DEF=-6.4 GHI=-0.2 JKL=-0.3 I changed the regex to | rex field=result "(?<column>[^=]+)=(?<value>.*)" However, all the negative values are now positive. The x-axis is also a stacked side by side looking like this:      And also, Panel 1 and Panel 2's results are now being merged as well, with the xaxis being the 'tmp' which looks like this: 'ABC=1,DEF=2,GHI=3....'. The yaxis values has also been changed. How can I convert this portion back to the previous visualization without affecting the token being passed to panel 3?   ... View more

Hi, I've changed the conditions accordingly. Results form panel 1 and 2 are now merged in 1 line as verified using search.    Panel 3 now shows the different categories at the x axis, but the value at the yaxis is incorrect (everything is only in the second column summed up). i tried using list or table but was not able to get the output. I've check it on search and seems the the regular expression doesnt extract the value after the '='. And it also seems like the results are being compiled into one long column. Here is the code: .. ... | stats values(Total) as count by column | eval tmp=column."=".count | stats values(tmp) as tmp values(Total) as Total | eval count=mvjoin(tmp,";")</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <done> <set token="panel1">$result.count$</set> <set token="total1">$result.Total$</set> </done> ... ... | stats values(Total) as count by column | eval tmp=column."=".count | stats values(tmp) as tmp values(Total) as Total | eval count=mvjoin(tmp,";")</query> <earliest>$field2.earliest$</earliest> <latest>$field2.latest$</latest> <done> <set token="panel2">$result.count$</set> <set token="total2">$result.Total$</set> </done> ... ... <query>| makeresults | eval result1=split("$panel2$",";"), result2=split("$panel1$",";") | eval result=mvappend(result1,result2) | mvexpand result | fields - result1 result2 | rex field=result "(?&lt;column&gt;[^=]+)=(?&lt;value&gt;\d+)" | stats sum(value) as count by column</query> On top of resolving the issue to show the difference of panel 1 and 2 on panel 3, how I can show the results in panel 1 and 2 before the 'tmp' portion?    Thanks in advance ... View more

Hi I've tried to modify it to by adding the following at panel 1 and panel 2: ..... | stats values(Total) by column | eval tmp=sourcetype."=".count | stats values(tmp) as tmp values(Total) as Total | eval count=mvjoin(tmp,";")</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <done> <set token="panel1">$result.count$</set> <set token="total1">$result.Total$</set> </done> .... ... | stats values(Total) by column | eval tmp=sourcetype."=".count | stats values(tmp) as tmp values(Total) as Total | eval count=mvjoin(tmp,";")</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <done> <set token="panel2">$result.count$</set> <set token="total2">$result.Total$</set> </done>   And have added this at panel 3:   <search> <query>| makeresults | eval result1=split("$panel2$",";"), result2=split("$panel1$",";") | eval result=mvappend(result1,result2) | mvexpand result | fields - result1 result2 | rex field=result "(?&lt;sourcetype&gt;[^=]+)=(?&lt;value&gt;\d+)" | stats sum(value) as count by sourcetype</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> However I faced two issues here and would like to seek your help on it: 1. Panel 3 shows "Search is waiting for input" 2. Panel 1 and 2 now shows "No result found" instead of the previous column chart like what was intended:   ... View more

Hi,  Thanks for your reply. Seems to be getting closer. However, the calculations at panel 1 and 2 are for multiple categories.   Panel 1: ... | chart values(Total) as TOTAL1 by column   Panel 2: ... | chart values(Total) as TOTAL2 by column   The final eval $panel1$-$panel2$ is also for multiple categories (for the 'by column' portion).    How I can I modify it to pass the results with the 'by column' criteria? For example:  The intended output is to pass the value to the lowest panel Thanks in advance! ... View more

Hi ITWhisperer, Thanks for your reply, I agree with your point. Seems like an overlay chart may not be the most flexible way to approach this. We are thinking of just showing the difference between period A and B. Is there a way to pass a value from 1 panel to another? For example in a dashboard, Panel 1 shows the measurement based on time picker1 and Panel 2 show the measurement based on time picker2. Is there anyway I can calculate the difference in measurement in a separate Panel within the same dashboard? Perhaps passing a token from the eval results from panel 1 and 2, and then calculating at a separate panel?   Here's a sample of my failed attempt: <label>Difference between Panel 1 and Panel 2</label> <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>1572566400</earliest> <latest>1604275200</latest> </default> </input> <input type="time" token="field2"> <label></label> <default> <earliest>1572566400</earliest> <latest>1572652800</latest> </default> </input> </fieldset> <row> <panel> <title>Day1</title> <chart> <search> <query> ... ... ... | eval ABC=round(XYZ/1000,3) </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <done> <set token="Day1">$ABC$</set> </done> <sampleRatio>1</sampleRatio> </search> </chart> </panel> <panel> <title>Day2</title> <chart> <search> <query> ... ... ... | eval $Day1$-$Day2$ </query> </search> </chart> </panel> Thanks! ... View more

Hi ITWhisperer, Thanks for your reply. Yes, I agree with you that the period selected for the 2 data sets should be of the same type (i.e Month, Day, Week).  I understand your point, but am unsure of how to approach this. For periods for Year/Month, I can input the choice one by one. However, for periods of Weeks/specific day, it may be difficult to populate them one by one- is there a function to do this automatically? And also, may I kindly request to have a sample of the select list in sequence of Year > Month > Day, which goes in sequence - e.g. Year by default will be current year, where as month will be current month, and day will be ALL.  Thanks in advance. ... View more

Hi, Yes, the user requirement is to have flexibility when selecting the time periods. As the time intervals to be compared are not regular, it needs to be flexible ( i.e the comparison can be Month 1 vs Month2, Week1 vs Week2, Day1 vs Day2 etc.). A multi-select may limit its flexibility for this case.  Is there anyway for this?  ... View more

Hi to4kawa, Thanks for your input. However, I noticed that there is only 1 time input; <input type="time" token="field1">  ... (earliest=$field1.earliest$ latest=$field1.latest$)   Is there any way to include a second time picker in this situation when I define the 'earliest' and 'latest'? After including this, how can it be incorporated into the query conditions and xyseries command? I would like to compare 2 separate time period in 1 xyseries chart - the 2 separate period needs to be flexible as they may not be continuous (E.g. Week 1 of 2019 vs Week 25 of 2020, Day 12 of Sept 2020 vs Day 25 of Oct 2020, Oct 2019 vs Oct 2020, etc.). ... View more

Hi, I'm now able to plot it. Thanks!   To add on to that, I currently have it in my dashboard and I am trying to add a picker picker option to set the 2 separate months (might not be in sequence, e.g January Vs June).   Since the earliest and latest is defined by -2mon@mon and -0mon@mon, I'm unable modify it.    I've tried using the token in the dashboard but was not able to display the correct month and legend. Any advise on this issue.    Thanks! ... View more

  Hi,    I have tried based on your suggestion but it shows 'no results found'    I have also modified it based on my requirement (there are 2 key conditions and the final graph's xaxis should be shown in a discrete form based on condition1) understand.    -- base query | eval date_mday=printf("%02d",date_mday)  | eval month=strftime(_time,"%m")    |stats count as ABC by date_mday, month, condition1, condition2    |eval EFG=round (ABC/1000,3)    |stats sum(EFG) as 'XYZ' by condition1, date_mday, month    |xyseries condition1, date_mday month    | stats sum(count) as count by date_mday month | xyseries date_mday month count     Question 1: Do note that there are some calculations in values in front, will this impact the use of xyseries?      Question 2: Based on your reply  Answer 5: xyseries specifies which dimensions you want on the x-axis (day_mday), y-axis (count) and series (date_month) (it might have been better to call it xseriesy to make it easier to remember the order of the parameters!)    My requirement is for the X axis to be discrete unique assets and y axis to be a value for 2 different periods. Maybe I can provide u an analogy;    To compare the difference in expenses for different areas over August and september.  So for this case, the X axis will be transport , leisure and food - represented in 3 separate points. The y axis will be the value of $$ which was previously calculated based on several conditions.  The graph will be shown in 2 lines, one red which represents August spendings and one yellow which represents Spetember spends.      Question 2:  is your suggestion for this output? There may be some miscommunication.    Thanks! ... View more

Hi IT whisperer.  Thanks for your reply, now I understand how 'xyseries' works.  I believe what I intend to plot can be done using 'xyseries'   This is a sample of requirement on excel. With that, I believe that using xyseries, the first input should be 'Item' to represent the item1-6 on the X axis. Y Y should be Measurement(August or any month that's previously defined) and.  Is there anyway to define the month? I've tried briefly but it couldn't work: E.g. eval prev1mon = strftime( _time, "%M) .. eval prev2mon =.....   |stats sum(X1) as measurement1 by item, prev1mon |stats sum (X2)  as measurement2 by item, prev2mon |xyseries item measurement1 measurement2    Is this the correct approach? And how should this be changed to reach my intended output?    Thanks in advance!   ... View more

Hi ITWhisperer, Thanks for the detailed explanation.   However, I still couldn't get the output I want. Is there another option to use the 'Chart Overlay' when creating a dashboard? Can i pass another value from another chart to this 'Overlay'?   Thanks.   ... View more

Hi ITWhisperer, Thanks for your reply. I'm trying to understand the your reply but couldn't get the query to work.    I understand that by starting off with earliest=-2mon@mon and latest=-@mon, it bounds the timeframe to current month-1 and current month -2 (i.e now its October, so the data will be between start August and end September" However, what I couldn't quite understand is the following: | eval date_mday=printf("%02d",date_mday) Question 1: May I know what the printf function does and how "%02d" divides the data into August and September? Question 2: Shouldn't there be 2 of such an 'eval' i.e  eval date_1=printf(xxxx, date_1) to set the boundary between start and end August eval date_2=printf(xxxx, date_2)  to set the boundary between start and end September. Question 3: Lets say I want to specify a date for date_1 and date_2, how can i change the line? - I've tried eval date_2=printf("1/1/2020, date_2) while setting the timepicker to all time and no defining the 'earliest' and 'latest' at the start - but faced an error message.     Question 4: What does date_month represent in the case below? Does it not require an 'eval' like when date_mday was defined? | stats sum(count) as count by date_mday date_month  for my case, I am performing a series of eval and stats sum by several fields in order to get the final value. sample: |stats latest(fieldX) as X, earliest(fieldY) as earliest Y by field1, field2 |eval A=X-Y |stats sum(A) as B by field 2 I'm trying to plot this value B (a barchart that is based on field 2 which is unique) and compare the different between the previous month and the month before it. Question 5:   | xyseries date_mday date_month count  With my requirement for this, should the plotting of chart be like: |xyseries date_1 date_2 B   Apologies for the long list of question as I am new to Splunk.   Thanks in advance. ... View more

Hi, Thanks for the reply. Noted that the earliest and latest command is at the start of the spl. However, I am trying to compare 2 months of data using a linechart. How can I go about overlaying the charts by setting the earliest and latest point? (i.e. Put August line chart over Sept line chart) - and later on calculating the different and putting it in a separate chart. Thanks and apologies as I am quite new to Splunk. ... View more

Hi, I've checked my query and it works fine - i.e I'm able to get the correct calculations after the splunk search. However, I was still unable to present the data in the intended way using timechart. Are there alternative commands that may be useful for this? Thanks. ... View more

Hi to4kawa, Thanks for the reply. However, I'm not to sure where my previous search fits here. I've tried to fit in the earlier lines as best as I could but it still shows 'No results found' I have a few times of calculation to evaluate readings (not counts) before presenting in the above mentioned manner.   Thanks. ... View more

Hi ITWisperer, I've tried it but it shows "No results found". Instead, is there a way to set timepicker by day, and stitch it together with others days of the month to form a monthly report? Thanks. ... View more