I'm an intermediate Splunk user. I have a query that has 3 fields i want to turn into a chart: 1. mySearchTerm (string) 2. geoID(10 values, each is a unique 5 digit number: 10010, 20020, etc...) 3. the count of searchTerms that appear per geoID
I am able to get a table going using:
<main query> | stats count(mySearchTerm) as myCount BY geoID, mySearchTerm
| table geoID myCount mySearchTerm
But when I go to build a visualization of any kind (bubble, scatter, etc) the layout looks wrong. I'd like to create a visualization of count of mySearchTerm broken down by geoID
2 part question:
1. Does my query seem appropriate for my intended use?
2. Is there a specific chart type that is more suited for this information?
... View more