Dear Team,
I am trying to build a chart like this:
- x-axis is the website name
- y-axis is the number of request to that website
- on top of the bar for Website, I want to display the ut_shannon value of that website.
Is there anyway that we can do it?
SearchTerm (anything like sourcetype="access*" ) | chart count as "Number of Request to Website" over websitename
1) save this report to a dashboard.
2) Add panel new >Event > type same search and extract that field (ut_shannon )
3) Save this panel on top of your dashboard.
please upvote and mark my answer correct if this works for you thanks 🙂
don't hesitate to ask me for any further doubt
Hi,
Similar to this question it appears:
https://answers.splunk.com/answers/111704/values-on-the-bar-chart.html
Which is using this as the search:
....<your search using chart/stats like count by somefield> | eval somefield=somefield."-".count
but instead yours will be something along the lines of:
* | chart ... by somefield | eval <whatever>=somefield." - ".ut_shannon
Then in 6.3 and later you should be able to show the values on the actual chart by:
Format > General > Show Data Values > On
Yes, i will try both solutions now to see which one is working. Thank you everyone.