Splunk Search

How to create a bar chart from a field that contains a list of values?

dan_pudwell
Explorer

I am trying to create a bar chart from a field that could have 0 or multiple values delimited with ;

An example of the data is:

{"auditSource":"frontend","auditType":"Results","eventId":"4a99edaf-cc97-4e19-9146-1a2a4cb90856","tags":{"clientIP":""},"detail":{"successful":"false","errorCodes":"56004;56003"},"generatedAt":"2016-01-28T21:50:35.320Z"}

So I know that detail.errorCodes will give me the value '56004;56003', but I'm not sure how to separate these and create a bar chart from the result.

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Would the following work for you?

| yoursearch
| eval code = split('detail.errorCodes', ";")
| mvexpand code
| stats count by code

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Would the following work for you?

| yoursearch
| eval code = split('detail.errorCodes', ";")
| mvexpand code
| stats count by code

dan_pudwell
Explorer

Hello, cheers for the answer. However it doesn't work. It says "'Field 'code' does not exist in the data."
It just returns all the events matching the search.

0 Karma

javiergn
SplunkTrust
SplunkTrust

That's because i forgot the single quotes with the field name.
I've fixed my answer above. Please try again:

| yoursearch
| eval code = split('detail.errorCodes', ";")
| mvexpand code
| stats count by code
0 Karma

dan_pudwell
Explorer

Awesome! works great, Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...