Splunk Search

Using Chart over two fields grouped by time

kabiraj
Path Finder

Hi Guys,

I am trying to pull up a table containing Time, Channel & Popularity as fields.

I am using : chart useother=f max(position) over Channel by Time

Above gives me only Channel & Time as fields in the table but i want Channel, Popularity & Time as fields.

I tried : chart useother=f max(position) over Channel Popularity by Time

But failed as it showed a syntax error.

Below is a sample of result

Channel 03-Nov-15 04-Nov-15
Watch 27 29
Universal 14 15
TLC HD 54 64
TLC 21 20

I want Popularity to be added besides the Channel field

Any Ideas?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | eval Channel_and_Popularity = Channel . ":" . Popularity | chart useother=f max(position) OVER Channel_and_Popularity BY Time

View solution in original post

woodcock
Esteemed Legend

Like this:

... | eval Channel_and_Popularity = Channel . ":" . Popularity | chart useother=f max(position) OVER Channel_and_Popularity BY Time

kabiraj
Path Finder

Hi Woodcock! Thanks for your prompt response but i want Channel & Popularity as two different fields instead of appending it into one delimited by ":".

Below is the example :

Channel Name Popularity 04-Nov-15 05-Nov-15
1 Sky Movies Premiere 1 78 74
2 Sky Movies Showcase 2 82 71
3 Sky Movies Greats 3 80 72
4 Sky Movies Disney 4 77 66
5 Sky Movies Family 5 81 75
6 Sky Movies Action & Adventure 6 79 60

Any other suggestions will be highly appreciated. 🙂

0 Karma

woodcock
Esteemed Legend

Like this:

 ... | eval = Channel . ":" . Popularity | chart useother=f max(position) OVER Channel_and_Popularity BY Time | rex field=Channel_and_Popularity "(?<Channel >[^:]+):(?<Popularity >[^:]+)" | fields Channel Popularity *-*
0 Karma

kabiraj
Path Finder

Works like a Charm! Thank you! I think the Combination & splitting of fields and *-* did the trick. Thanks for sharing your expertise.
Just wanted to ask can we show N number of fields in the table just by giving *-* in the query?

0 Karma

woodcock
Esteemed Legend

Yes, but they must be 1-to-1 (In other words each value deterministically maps to a single value in each of the joined fields).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...