Splunk Search

Bar chart with multiple series

pitmod
Explorer

Hello,

I have the following data

book="title1" reader="reader1"
book="title1" reader="reader1"
book="title1" reader="reader2"
book="title1" reader="reader2"
book="title2" reader="reader1"
book="title2" reader="reader3"
book="title2" reader="reader3"
book="title2" reader="reader3"
...

 

I'd like to represent it in a multi-series bar chart showing number of reads by reader per title as in a drawing below:

count
^
|   _____________     _____________
|   |                                |     |                                 |
|   |_reader1_____|     |                                 |
|   |                                |     |_reader3_____ |
|   |_reader2_____|     |_reader1_____ |
----------------------------------------------------> titles
         title1                                   title 2

Labels (3)
0 Karma
1 Solution

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust
| makeresults | eval _raw="book,reader
title1,reader1
title1,reader1
title1,reader2
title1,reader2
title2,reader1
title2,reader3
title2,reader3
title2,reader3"
| multikv forceheader=1
| stats count  by book,reader
| chart values(count) as count over book by reader
  • use column chart
  • under format in general set "stacked" to stack mode

Note: stacked is middle option of stack mode.

thambisetty_0-1602597042294.png

 

————————————
If this helps, give a like below.
0 Karma

rnowitzki
Builder

Hi @pitmod ,

Should work with this simple SPL:

|  chart count by book, reader



book_title.PNG

BR
Ralph

--
Karma and/or Solution tagging appreciated.
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...