Splunk Search

How to get multiple legends on x-axis?

paritoshs24
Path Finder

Hi Team,

Following is my data:

SS TT DT DA LT LA TO TA
a xxx 4 3 2 3 7 6
a yyy 2 2 2 3 4 5
b xxx 1 1 1 1 3 3
b yyy 1 1 1 1 1 1

 

following is the graph i can  populate in excel

paritoshs24_0-1652390456218.png

Following is the graph I was able  to populate in splunk

paritoshs24_1-1652390498027.png

 

 

 

 

 

My problem is I can "SS" written in the Splunk graph, also I can see "a" "b" written in the graph....but along from these i also need  "xxx"  "yyy" to appear as legend under all 4 graphs.
how can we do that? 

MY QUERY FOR DATA 
|stats sum(* ) by SS,TT
|foreach sum* [eval <<FIELD>> = round(('<<FIELD>>' * 1000),2) ]
|rename sum(*) as *
|stats values(*) by SS,TT
|rename values(*) as *
|table SS,TT,DT,DA,LT,LA,TO,TA

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT

View solution in original post

paritoshs24
Path Finder

Thanks a  lot !! You saved me  so much of Energy !! 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Simple answer  is that it is not how standard charts work.

You could merge SS and TT

| eval SS=SS.":".TT
| fields - TT
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...