Reports in Splunk - Splunk Essentials - page 90

Creating a bar chart
Another common way to view data like this is to use a bar chart. For example, such a chart
can be used to show the viewer the relative proportions of those who use method=POST ,
and those who make purchases.
1. To create a bar chart, you can enter the following code in the search bar:
sourcetype=access* | timechart
per_minute(eval(method="POST")) AS Views
per_minute(eval(action="purchase")) AS Purchases
2. Let's go through this next step carefully. We begin by searching for all events with
a sourcetype that begins with access are collected. Then we use the timechart
command and the per_minute function to first give us a figure for the number
of events per minute that use method="POST" , and then label it as Views . In
addition, we use the per_minute function to find the number of events per
minute that have action="purchase" , and then label the results as
Purchases .
3. Go to the Visualizations tab and select Bar .
You should see a chart like the one shown in the following screenshot: