Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Append static data to a field for charting

$
0
0
Hello, I am trying to append static data to a chart that splunk generates and i'm not sure how to do this with a lookup or anything. The end goal is to have additional x-axis entries (`ProjectNames`) on my chart with arbitrary values for `Severity`, alongside the actual real data found in our splunk index. Here is what it currently looks like: ![alt text][1] index=myindex | rename CxXMLResults.@ProjectName as ProjectName | rename CxXMLResults.@Team as Team | rename CxXMLResults.Query.Result.@Severity as Severity | rename CxXMLResults.Query.Result.Path.@PathId as PathId | eval deduper=md5(Team.ProjectName.PathId) | dedup deduper | fillnull value='' | append [eval ProjectName="MyArbitraryProject"] | chart count(Team) over ProjectName by Severity in the `|append [eval ProjectName="MyArbitraryProject"] ` I Am trying to make a new project called "MyArbitraryProject" that will show up on the X axis, but obviously this doesn't work because I dont have `Severity` values available for it. Please help! I'm stumped. [1]: /storage/temp/270701-screenshot-from-2019-02-28-16-44-51.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>