I'm trying to create 1 bar chart to kill 2 views, my search is as follows;
sourcetype="error log" severity=ERROR | top limit=10 error_code by host
and yields
host error_code count
app1 code0001 300
app1 code0002 171
app1 code0003 145
app2 code0001 546
app2 code0002 197
app2 code0003 146
app3 code0001 412
app3 code0002 168
app3 code0003 149
i am looking for a simple bar chart of error_code on Y-axis and count on X-axis however, the x-axis should be stacked so that i can see code001 broken down/chunked out into 3 sections of host#
please help
I think this should do the trick:
| chart values(count) AS count BY error_code host
Make sure your visualization is set to stacked mode (under Format).
I think this should do the trick:
| chart values(count) AS count BY error_code host
Make sure your visualization is set to stacked mode (under Format).
thank you!!! works as intended!
am still trying to learn all the splunk graphing command fundamentals ^^