Dashboards & Visualizations

How can I get the chart to display more information /field values?

fere
Path Finder

Hi,
I have the following search:

 ..... | search EnterPlace | bucket _time span=7day 
| stats dc(user_id) as unique_visitors by _time, world_name 
| top unique_visitors, world_name limit=5 by _time 
| fields _time, unique_visitors, world_name 
| sort _time, -unique_visitors, world_name

The table will correctly return the results for: \ _time unique_visitors world_name

When I click on the Results chart icon, the chart comes up with columns for unique_user_visits. the date is on the x-axis. However, when I hover over the points on the chart, I don't see the value for the place_name. Is there anyway to have the chart present that information as well, in one way or another? WIthout that information, the chart is useless! We want to see the top places charted (the name of the place and the number of visitors to that place) by week

Many thanks in advance

Tags (3)
0 Karma
1 Solution

mataharry
Communicator

A chart with time expects a particular setup of columns.

  • the first column has to be the time (_time)
  • any other columns has to be from the same format (numeric) and the name of the columns will be the name of the serie.

example :

 _time fieldA fieldB ... fieldZ
9/19/12 12:00:00.000 AM valueA valueB ... valueZ
9/12/12 12:00:00.000 AM valueotherA valueothervalueB ... myothervalueZ

Instead your search present the results as:
_time unique_visitors world_name
(as the top and stats generate them)

One solution is to use the chart command at the very end to change the setup of the columns.

..... | search EnterPlace |  bucket _time span=7day 
| stats dc(user_id) as unique_visitors by _time, world_name 
| top unique_visitors, world_name limit=5 by _time 
| chart values(unique_visitors) over   _time by world_name

Another solution is to replace the whole stats by a timechart span=7d ... by world_name
but it will not be compatible with the top you apply after.

View solution in original post

0 Karma

mataharry
Communicator

A chart with time expects a particular setup of columns.

  • the first column has to be the time (_time)
  • any other columns has to be from the same format (numeric) and the name of the columns will be the name of the serie.

example :

 _time fieldA fieldB ... fieldZ
9/19/12 12:00:00.000 AM valueA valueB ... valueZ
9/12/12 12:00:00.000 AM valueotherA valueothervalueB ... myothervalueZ

Instead your search present the results as:
_time unique_visitors world_name
(as the top and stats generate them)

One solution is to use the chart command at the very end to change the setup of the columns.

..... | search EnterPlace |  bucket _time span=7day 
| stats dc(user_id) as unique_visitors by _time, world_name 
| top unique_visitors, world_name limit=5 by _time 
| chart values(unique_visitors) over   _time by world_name

Another solution is to replace the whole stats by a timechart span=7d ... by world_name
but it will not be compatible with the top you apply after.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...