Dashboards & Visualizations

how todisplay more than one field on bar chart

navd
New Member

I want to set up a Bar graph that displays more than one field when I hover over it. For example I use:

search | chart count over host by IP_address

so this is displaying just the host on the actual graph BUT also shows me the IP_address if I hover over my mouse to that specific bar.

Now, I also want to add one more field to display when I hover on a specific bar .

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

The chart command support aggregation by just two fields, so you'd have to try the workaround of concatenating two fields into one and use concatenated field in by clause.

search | eval "IP_address/OtherField"=IP_address.":".OtherField | chart count over host by "IP_address/OtherField"

View solution in original post

0 Karma

somesoni2
Revered Legend

The chart command support aggregation by just two fields, so you'd have to try the workaround of concatenating two fields into one and use concatenated field in by clause.

search | eval "IP_address/OtherField"=IP_address.":".OtherField | chart count over host by "IP_address/OtherField"
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...