Splunk Search

How to add a column to a chart?

andrewygray
New Member

I am trying to add a column to my current chart which has "Customers" as one column and "Users" as another.

e.g.                 Customers                                              Users
                     Wells fargo                                            abc@wf.com
                                                                            123@wf.com
                                                                            TestAccount@wf.com

                     UBS                                                    lol@ubs.com
                                                                            TestAccount2@ubs.com

But I want to make a third column of all the test accounts for each customer like so:

e.g.                     Customers                          Users                             Test Accounts
                         Wells fargo                        abc@wf.com                        TestAccount@wf.com   
                                                            123@wf.com

                         UBS                                lol@ubs.com                       TestAccount2@ubs.com

I know I can filter on the userid so I am able to get two separate charts but I don't know how to merge them. Can someone help?

Here are my searches for each chart:

index=info | chart values(userid) by Customer_Name | rename values(userid) as "User", Customer_Name as "Customer"

index=info userid="TestAccount*" | chart values(userid) by Customer_Name | rename values(userid) as "User", Customer_Name as "Customer"   
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this
Updated

index=info | stats values(userid) as userid by Customer_Name 
| eval User=mvfilter(NOT match(userid,"TestAccount"))
| eval TestAccount=mvfilter(match(userid,"TestAccount"))
| rename Customer_Name as Customer
| table Customer User TestAccount

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this
Updated

index=info | stats values(userid) as userid by Customer_Name 
| eval User=mvfilter(NOT match(userid,"TestAccount"))
| eval TestAccount=mvfilter(match(userid,"TestAccount"))
| rename Customer_Name as Customer
| table Customer User TestAccount
0 Karma

DalJeanis
Legend

@somesoni2 - missing open paren on second mvfilter.

andrewygray
New Member

Thank you! This is exactly what I needed

0 Karma

somesoni2
Revered Legend

Thank you sir.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...