I am trying to merge two charts together. Both charts have two dimensions each with one common dimension - making three total.
Following the advice given in link text, I use the following search to return a string, number, number:
MY SEARCH | stats sum(count) by location date_month
Which returns results in the "statistics" tab that look something like this:
Location, date_month, count
Copper River, 5, 300
Copper River, 6, 300
Copper River, 7, 325
Bear River, 5, 120
Bear River, 6, 200
Bear River, 7, 177
Unfortunately, when I click the "visualization" tab and select "bubble" the table is blank. What did I do wrong?
I have also tried to understand and follow the advice given link text but it appears that in the example link text, the search results need to yield four fields to use the bubble visualization properly.
It seems there is an easy way to implement the "bubble" feature of splunk search visualization and I am just missing it. Any suggestions?