HenlenLee
Reputation: 445
How to convert "OR" result to line chart
I have a query to get the browser info for every event.
"http://" index=web GET (Chrome OR Safari OR IE OR Firefox)
How can I convert the result to a line chart to get browser usage based on different browsers? I can create line chart for each browser but I want to show the usage on the same chart.
Upvotes: 1
Views: 34
Answers (1)
Tsakiroglou Fotis
Reputation: 1031
The browser should be a Field (check your log body to find field name).
If this is a case you need to pipe a stats count statement, for example :
"http://" AND index=web | stats count by `browser`
(we assume that Field name is browser)
Visualization will give you the chart view.
Upvotes: 1
Related Questions
- Separate multiple search values with an OR clause with Splunk?
- Splunk: Combining multiple chart queries to get a single table
- How to do compound query with where clause in Splunk?
- Splunk: How to apply conditionals for multiple rows with same column value?
- Splunk: combine fields from multiple lines
- SPLUNK multi-value chart
- How to chart a search that returns event with multiple facets that have a name/result pair in Splunk
- bar chart based on field values
- How to combine two queries in Splunk?
- Splunk query to filter results