Knowledge Management

How to question mark fields

harishyhrk
New Member

How to mark the fields with a question.

Tags (1)
0 Karma

niketn
Legend

@harishyhrk, I am not sure if this was intentional, seems like you have wiped off your question with a new one but with only partial information. Requesting you to retain your original question here since answers have been provided with respect to the same. If the issue has been resolved, requesting you to accept the same as well.

Also, for a question on different lines, requesting you to post a new question.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@harishyhrk, if your current query is giving your Total_Time, Average and Minimum Columns for two Environments and you need it to be inversed, you should use the transpose command as the final pipe in your current query i.e.

  <YourCurrentSearch>
  | transpose header_field="Environment" column_name="Environment"

Following is a run anywhere search based on Splunk's _internal index. (PS: All data/stats is cooked up to generate some chart as per what you currently have).

alt text

index=_internal sourcetype=splunkd component!="ConfContentsCache" (log_level="WARN" OR log_level="ERROR")
| stats sum(date_second) as Total_Time avg(date_second) as Average min(date_second) as Minimum by log_level
| replace "ERROR" with "OpenShift" in log_level
| replace "WARN" with "Onpremises" in log_level
| rename log_level as Environment
| transpose header_field=Environment column_name=Environment
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Actually I wanted to say non-stacked option (sorry about that). I create a runanywhere search to generate sample data as yours and use basic column chart for visualization and got this. Does it match what you need?

Search:

| gentimes start=-1 | eval temp="openpremisis#10.1111#8.2222#2.33333 openshift#12.4444#8.55555#2.66666" | table temp  | makemv temp | mvexpand temp | rename temp as _raw | rex "(?<Environment>.+)#(?<Total>.+)#(?<Average>.+)#(?<Minimum>.+)"  | table Environment Total Average Minimum

Output chart:

alt text

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try with column chart with stacked option (no Trellies)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...