Splunk Search

Split results from chart

nadeige1
Engager

Hello,

I am using the chart command in order to display data using a line chart:

| chart values("torque") as variable over sort by HoleNb

 

But I get the following results:

nadeige1_0-1618503870108.png

Therefore, visualisation is not initialized properly. How do I split the results in order to have something like this?

sort2941294529462948295029512952295429552957OTHER
50
2330
2180
2050
2180
2520
1740
2120
2830
2330
2050
1150
50
2890
2700
2700
3230
3290
2770
3360
2890
2520
2830
1210
50          
1280
50          
1340
50          
1400
50          
1490
Labels (1)

ITWhisperer
SplunkTrust
SplunkTrust

Your issue is that chart values has create multi-value fields of different lengths. However, starting from the chart you have created, you could do something like this:

| makeresults 
| eval _raw="sort,2941,2945,2946,2948,2950,2951,2952,2954,2955,2957,OTHER
50,2330,2180,2050,2180,2520,1740,2120,2830,2330,2050,1150
50,2890,2700,2700,3230,3290,2770,3360,2890,2520,2830,1210
50,,,,,,,,,,,1280
50,,,,,,,,,,,1340
50,,,,,,,,,,,1400
50,,,,,,,,,,,1490
60,2335,2185,2055,2185,2525,1745,2125,2835,2335,2055,1155
60,2895,2705,2705,3235,3295,2775,3365,2895,2525,2835,1215
60,,,,,,,,,,,1285
60,,,,,,,,,,,1345
60,,,,,,,,,,,1405
60,,,,,,,,,,,1495"
| multikv forceheader=1
| fields - _* linecount
| untable sort HoleNb Torque
| chart useother=f values(Torque) as Torque by sort HoleNb
``` The above creates a chart similar to yours. I added an extra sort value in case you actually have more than one row. ```


| streamstats count as row 
| foreach * 
    [| eval mvc_<<FIELD>>=mvcount('<<FIELD>>')]
| foreach mvc_*
    [| eval max_rows=if(isnull(max_rows),'<<FIELD>>',if('<<FIELD>>'>max_rows,'<<FIELD>>',max_rows))]
| fields - mvc_*
| streamstats sum(max_rows) as top_row
| append 
    [| makeresults 
    | eval top_row=1
    | eval row=1
    | fields - _time]
| makecontinuous top_row
| sort - top_row
| filldown
| sort row top_row
| streamstats count as mvrow by row
| fields - max_rows row top_row
| foreach *
    [| eval <<FIELD>>=if("<<FIELD>>"!="sort" AND "<<FIELD>>"!="mvrow",mvindex('<<FIELD>>',mvrow-1),'<<FIELD>>')]
| fields - mvrow
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @nadeige1,

Can you try with list function?

| chart list("torque") as variable over sort by HoleNb
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...