Need a Dashboard To show past 3 days web hits by each site and total for each day. I need output like below.

[a527572]

Query using :
earliest=-3d@d latest=@d index=xyz host=l*xyz* source"xyz" | eval weekday=strftime(_time, "%b %d, %A ") | chart count(JVM) over JVM by weekday|sort weekday | join JVM [ search earliest=-3d@d latest=@d index=xyz host=l*xyz* source"xyz" | chart count(JVM) over JVM by host ]

with the Query I am using getting results like below.

[somesoni2 · Accepted solution]

The column merge (like excel) is not possible in Splunk. Give this workaround a try

earliest=-3d@d latest=@d index=xyz host=l*xyz* source"xyz" | eval weekday=strftime(_time, "%b %d, %A") | stats count(JVM) as count by JVM weekday host | appendpipe [| stats sum(count) as count by JVM weekday | eval host="Total"] | eval weekday=weekday.":".host
| chart sum(count) over JVM by weekday limit=0

[a527572]

Thanks for the reply... I am completely new to splunk. can you explain me how to build a dashboard for the following.
• To show 24 hrs web hits report by each Host + Total
• To show past 3 days web hits by each Host and total for each day
• To show past 7 days web hits for each JVM (total only). (Not Host specific).

[somesoni2]

Give these a try

• To show 24 hrs web hits report by each Host + Total

index=xyz host=l*xyz* source"xyz" earliest=-24h | stats count by host | eventstats sum(count) as Total

• To show past 3 days web hits by each Host and total for each day

earliest=-3d@d latest=@d index=xyz host=l*xyz* source"xyz" | eval weekday=strftime(_time, "%b %d, %A") | chart count over host by weekday

• To show past 7 days web hits for each JVM (total only). (Not Host specific).

 earliest=-7d@d latest=@d index=xyz host=l*xyz* source"xyz" | eval weekday=strftime(_time, "%b %d, %A") | chart count over JVM by weekday

[sundareshr]

I think the closest you can come to that is as shown in this run anywhere sample. I am not aware of any way to merge cells they way you have it in your mock-up

index=_internal bytes=* earliest=-1d@d | eval wkday=strftime(_time, "%a") | eval sourcetype=wkday."#".sourcetype | chart min(bytes) as b over source by sourcetype