Implementing Splunk 7, Third Edition - Third Edition

Using chart to turn data

The chart command is useful for turning data across two dimensions. It is useful for both tables and charts. Let's start with one of our examples from stats:

sourcetype="tm1*" error | chart count over date_month by date_wday

The resultant table looks like this:

If you look back at the results from stats, the data is presented as one row per combination. Instead of a row per combination, chart generates the intersection of the two fields. You can specify multiple functions, but you may only specify one field each for over and by.

Switching the fields (by rearranging our search statement a bit) turns the data the other ...