Splunk Search

How to chart multiple fields over time on one graph and create a table summarizing totals by user?

cpalicensing
New Member

Using the base search listed below it presents me with all print jobs, one print job per user. I would like to chart the fields "Total Pages" by "Full Name" for all users(all results) over time on one graph. In total there are around 37 users and several random "Total Page" counts. Thinking of using a line graph. What would be the best way to complete this?

I then would like to create a table that totals all pages printed by user. So adding the "Total Pages" field, by "Full Name" in a table.

Base Search:

index="win_custom" sourcetype="print-job-accounting-report" 

alt text

Thank you!

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @cpalicensing,

Does this work for you ?

Chart

index="win_custom" sourcetype="print-job-accounting-report"|timechart span=1d values("Total Pages") by "Full Name"

If this doesn't fit , please let us know what aggregation you want to do on "Total Pages". Also adjust the span min,day,hour etc

Table

    index="win_custom" sourcetype="print-job-accounting-report"|stats sum("Total Pages") by "Full Name"
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @cpalicensing,

Does this work for you ?

Chart

index="win_custom" sourcetype="print-job-accounting-report"|timechart span=1d values("Total Pages") by "Full Name"

If this doesn't fit , please let us know what aggregation you want to do on "Total Pages". Also adjust the span min,day,hour etc

Table

    index="win_custom" sourcetype="print-job-accounting-report"|stats sum("Total Pages") by "Full Name"
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...