Splunk Search

How to add a column to a chart?

andrewygray
New Member

I am trying to add a column to my current chart which has "Customers" as one column and "Users" as another.

e.g.                 Customers                                              Users
                     Wells fargo                                            abc@wf.com
                                                                            123@wf.com
                                                                            TestAccount@wf.com

                     UBS                                                    lol@ubs.com
                                                                            TestAccount2@ubs.com

But I want to make a third column of all the test accounts for each customer like so:

e.g.                     Customers                          Users                             Test Accounts
                         Wells fargo                        abc@wf.com                        TestAccount@wf.com   
                                                            123@wf.com

                         UBS                                lol@ubs.com                       TestAccount2@ubs.com

I know I can filter on the userid so I am able to get two separate charts but I don't know how to merge them. Can someone help?

Here are my searches for each chart:

index=info | chart values(userid) by Customer_Name | rename values(userid) as "User", Customer_Name as "Customer"

index=info userid="TestAccount*" | chart values(userid) by Customer_Name | rename values(userid) as "User", Customer_Name as "Customer"   
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this
Updated

index=info | stats values(userid) as userid by Customer_Name 
| eval User=mvfilter(NOT match(userid,"TestAccount"))
| eval TestAccount=mvfilter(match(userid,"TestAccount"))
| rename Customer_Name as Customer
| table Customer User TestAccount

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this
Updated

index=info | stats values(userid) as userid by Customer_Name 
| eval User=mvfilter(NOT match(userid,"TestAccount"))
| eval TestAccount=mvfilter(match(userid,"TestAccount"))
| rename Customer_Name as Customer
| table Customer User TestAccount
0 Karma

DalJeanis
Legend

@somesoni2 - missing open paren on second mvfilter.

andrewygray
New Member

Thank you! This is exactly what I needed

0 Karma

somesoni2
Revered Legend

Thank you sir.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...