topic Re: RatioBar Example Usage in Dashboards & Visualizations

RatioBar Example Usage

srepetsk — Mon, 15 Aug 2011 18:33:05 GMT

I'm fairly inexperienced with writing complex charting XML in Splunk, and I'd like to see if anyone has an example for how to use RatioBar graphs. I'd like to create a graph of the count of all events over time, with the bars splitting out into the ratio of which hosts they came from (perhaps limiting to the top 5 or something). Thanks in advance

Re: RatioBar Example Usage

BobM — Mon, 15 Aug 2011 21:40:33 GMT

The easiest way to do this is in the advanced charting view.

Search app >> views >> advanced charting

... | timechart count by <field> limit=5 useother=f

Set chart type to "column" and stack mode to "stacked" or "100% stacked" if you prefer.

Re: RatioBar Example Usage

srepetsk — Thu, 18 Aug 2011 14:55:10 GMT

Excellent! Thanks