Hello,
I am trying to append static data to a chart that splunk generates and i'm not sure how to do this with a lookup or anything. The end goal is to have additional x-axis entries (`ProjectNames`) on my chart with arbitrary values for `Severity`, alongside the actual real data found in our splunk index. Here is what it currently looks like:
![alt text][1]
index=myindex
| rename CxXMLResults.@ProjectName as ProjectName
| rename CxXMLResults.@Team as Team
| rename CxXMLResults.Query.Result.@Severity as Severity
| rename CxXMLResults.Query.Result.Path.@PathId as PathId
| eval deduper=md5(Team.ProjectName.PathId)
| dedup deduper
| fillnull value=''
| append [eval ProjectName="MyArbitraryProject"]
| chart count(Team) over ProjectName by Severity
in the `|append [eval ProjectName="MyArbitraryProject"] ` I Am trying to make a new project called "MyArbitraryProject" that will show up on the X axis, but obviously this doesn't work because I dont have `Severity` values available for it. Please help! I'm stumped.
[1]: /storage/temp/270701-screenshot-from-2019-02-28-16-44-51.png
↧