Splunk Search

How to display my table in xyseries?

ASISH_9
Engager

I Have the following Display

Domain         Application      ReportingMonth        Price
ADD            Dotnet           1/1/2016              $1000
               DotNet
               DotNet
               Java
               Java

ABV            Javac            2/1/2016              $10000
               DotNet
               DotNet
               Java
               Java     

ABB            DotNet           3/1/2016              $1200
               DotNet
               Java
               Java

I want the above to be displayed in this format

1-2016     2-2016      3-2016                Domain    ApplicationGroup

$1000      $10000      $1200                 Java          ABB
$1000      $10000      $1200                 Dotnet        XYZ  
$1000      $10000      $1200                 sap           abv

how can I do it? i have already user xyseries and mvindex and split command. but the results aren't coming

0 Karma

sundareshr
Legend

Try this

base search resulting in the view described in your question | mvexpand Application | eval Domain=Domain."#".ApplicationGroup | chart values(Price) as Price over Domain by ReportingMonth | rex field=Domain "(?<Domain>[^#]+)#(?<ApplicationGroup>.*)" | table  Domain ApplicationGroup *
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...