Splunk Search

Single search in multiple charts

gimbil
Explorer

Hi All,

I have a search such as
search logs | ... |timchart count(eval(X="a")), count(eval(X="b)), count(eval(X="c")), …

Is there any way I can show the result, i.e., count of "a","b","c" and so one each on one chart in simple xml?

Thanks

Tags (3)
0 Karma

yong_ly
Path Finder

you could build a form with that basic root search and create three different panels charts subsearches or a saved search.

Since 'chart' represents on container and panel, I think you'd need to specific a search for it..

http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML

But since you're working in XML, it's relatively easy to just copy and modify the same container..

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can try searchTemplate and searchPostProcess modules of simple xml as follow:-

 <form>
 <label>PostProcess Example</label>  
  <!-- Search that returns all of the data that requested by subsequent panels -->
  <searchTemplate>
   search logs | ... |...
  </searchTemplate>

  <row>
          <chart>
            <title>Count of A over time</title>
            <searchPostProcess>timechart  count(eval(X="a"))</searchPostProcess>
             <option name="height">300px</option>
             <option name="charting.chart">area</option>
             <option name="charting.chart.stackMode">stacked</option>
          </chart>
  </row>  
  <row>
          <chart>
            <title>Count of B over time</title>
            <searchPostProcess>timechart  count(eval(X="b"))</searchPostProcess>
             <option name="height">300px</option>
             <option name="charting.chart">area</option>
             <option name="charting.chart.stackMode">stacked</option>
          </chart>
  </row> 
  <row>
          <chart>
            <title>Count of C over time</title>
            <searchPostProcess>timechart  count(eval(X="c"))</searchPostProcess>
             <option name="height">300px</option>
             <option name="charting.chart">area</option>
             <option name="charting.chart.stackMode">stacked</option>
          </chart>
  </row> 
</form>
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...