Splunk Search

Combining Multiple Fields in Charting

blurblebot
Communicator

Given a data set with events that fall into X categories and Y subcategories, can I display a chart that shows a column or portion-of-pie or bar for each combination of X/Y?

Example data set

server=main cat=a sub=1
server=alt cat=b sub=1
server=main cat=c sub=1
server=main cat=a sub=2
server=alt cat=b sub=2
server=main cat=c sub=2
server=main cat=b sub=3
server=alt cat=c sub=3

For the chart of the above data, the chart shows one bar for count of all cat=a/sub=1 events, one shows all cat=b/sub=1 events, etc.

Bonus Vocab Quiz: 1) what are the sections (bars, columns, portions of pie) of a chart to be referred to as in splunkese?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
... | eval series=cat."/".sub | chart count by series

I would refer to each section as a "series" or "data series".

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

If you have repeated "sub" values as in your example, you may want to consider a search like:

... | chart count by cat sub

This will make a table like:

cat 1 2 3
--- - - -
a   . . .
b   . . .
c   . . .

This is useful if you want a stacked column chart to be rendered in the UI, so that you can see each combination as well as the total for each category.

gkanapathy
Splunk Employee
Splunk Employee
... | eval series=cat."/".sub | chart count by series

I would refer to each section as a "series" or "data series".

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...