Splunk Search

How to chart with multiple values on legend

Dherom
New Member

I want to have different values ​​in the legend of a column and that the yaxis is a specific value of this legend.

sourcetype="securitycenter" asset=AMER_MS_SRV OR asset=EMEA_MS_SRV OR asset=APAC_MS_SRV 
|  rex field=asset "(?.*)_MS_SRV|"
|chart  eval(round(latest(crit),0)) as C by name |eval pos = case(name=="AMER","1",name=="EMEA","2",name=="APAC","3",name==name,"4") | sort pos| eval target=1 | table name, C, target

In this image I want to add Totips:totalvalue to legend and y-axis are "C".

alt text

Tags (3)
0 Karma

Dherom
New Member

I want add another value field 'totips' (on same char) and shown multiple values on same bar and this bar evaluated with 'C' field

thanks you for you answer

0 Karma

Dherom
New Member

i want other value to highligh linked.
Example

name:AMER
C:19
totips:890

but dont shown this bar(totips) in this panel. I did trellis values but i dont order by name, order by xaxys value(totips) and i want this.

0 Karma

tscroggins
Influencer

I don't think you can do this in a column chart. The tooltip HTML is created from a single series using the point value (X,Y) under the mouse pointer.

Are you open to custom solutions, or are you restricted to pure SimpleXML?

0 Karma

tscroggins
Influencer

Can you clarify your question? "Totips" isn't a field in your search. If you want to display e.g. "Totips: 19" in place of "C: 19" in the tooltip, then simply replace C with Totips in your search:

sourcetype="securitycenter" asset=AMER_MS_SRV OR asset=EMEA_MS_SRV OR asset=APAC_MS_SRV
| rex field=asset "(?.)_MS_SRV|"
|chart eval(round(latest(crit),0)) as **Totips
* by name |eval pos = case(name=="AMER","1",name=="EMEA","2",name=="APAC","3",name==name,"4") | sort pos| eval target=1 | table name, Totips, target

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...