Splunk Search

How to edit my search to display a distribution graph grouped by a field?

kualo
Explorer
[2016-xx-xx-xx:xx:xx:xxxx] modelName=model1, modelScore=10
[2016-xx-xx-xx:xx:xx:xxxx] modelName=model2, modelScore=100
[2016-xx-xx-xx:xx:xx:xxxx] modelName=model3, modelScore=50

My log looks something like above

 some search| stats count by modelScore | sort modelScore

I have the above search to show the distribution of the modelScore using bar visualization.alt text

However, I would like to show modelScore for each modelName in the same bar graph in different colors.
Is there any way I can do that?
Thanks.

1 Solution

gokadroid
Motivator

can you try this please based on whichever way you want to chart:

Keeping modelName on x axis

some search| chart  count over modelName by modelScore

OR
Keeping modelScore on x axis

some search| chart  count over modelScore by modelName

View solution in original post

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

You probably want to use some search| stats count by modelScore | makecontinuous modelScore as to add any potentially empty buckets/bins.

0 Karma

gokadroid
Motivator

can you try this please based on whichever way you want to chart:

Keeping modelName on x axis

some search| chart  count over modelName by modelScore

OR
Keeping modelScore on x axis

some search| chart  count over modelScore by modelName
0 Karma

kualo
Explorer

Thanks! I works perfectly.

0 Karma
Get Updates on the Splunk Community!

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...