topic Re: Problem to make my bar chart to be stacked in Dashboards & Visualizations

Problem to make my bar chart to be stacked

martinovm — Tue, 29 Oct 2013 18:22:18 GMT

Hi ,
I’m on Splunk version 4.3.2I have a simple query that I can render as a bar chart but I’ve a problem to make my bar chart to be stacked. Is there any requirement for the Splunk query in order to produce proper stacked bar chart. Is there something that I need to know?
Thanks,
Martin

Re: Problem to make my bar chart to be stacked

lukejadamec — Tue, 29 Oct 2013 18:33:35 GMT

What is your search?

Re: Problem to make my bar chart to be stacked

martinovm — Mon, 28 Sep 2020 15:07:45 GMT

Thanks, this is the search I've been playing with:
index=* request_id=$request_id$ |`rex_stats`|eval System_CPU_load = round(System_CPU_load *100\,2)|stats max(System_CPU_load) as max_cpu_usage by task_id,phase_id|eval xlabel=phase_id|chart avg(max_cpu_usage) by xlabel,phase_id|rename xlabel AS phase_id|rename avg(max_cpu_usage) as "Average CPU Usage(%)"

Re: Problem to make my bar chart to be stacked

sideview — Tue, 29 Oct 2013 19:03:07 GMT

The only search-language piece, is to make sure you're using the timechart or chart command to have one field's values basically down the left hand side of the table, and a second field's values listed along the column headers of the table. It looks like you're doing this already, and the rest of it is not something you do in the search language but rather in the dashboard settings.

If you're using the dashboard wizard UI look inside the "Edit Visualization" options for a "stacked" option. It should be pretty easy to find.

If you're hand-editing simple XML, then add

<option name="charting.chart.stackMode">stacked</option>

inside your <chart> element.

and if you're using the "Advanced XML", then put

<param name="charting.chart.stackMode">stacked</param>

inside a HiddenChartFormatter just upstream from your JSChart or FlashChart.

Re: Problem to make my bar chart to be stacked

martinovm — Mon, 28 Sep 2020 15:09:30 GMT

Hey, thanks a lot for your response. I’ve used the stacked
inside a HiddenChartFormatter but it hasn’t helped. The solution was to add proper second breakthrough parameter to the chart.In my case it was request_id: so I’ve changed my search query to this one:
index=* request_id=$request_id$ |rex_stats|eval System_CPU_load = round(System_CPU_load *100,2)|stats max(System_CPU_load) as max_cpu_usage by request_id,task_id,phase_id|chart avg(max_cpu_usage) by request_id,phase_id|rename avg(max_cpu_usage) as "Average CPU Usage(%)"

Re: Problem to make my bar chart to be stacked

qbolbk59 — Tue, 29 Sep 2020 22:13:47 GMT

Hi @sideview

I am also facing the same issue. I am using the below query to generate a stacked bar graph but somehow it's not giving me stacked bar graph output. I tried selecting the stacked graph option but didn't helped. Also tried adding the XML entry but still no luck.

Not sure what's the error.

Re: Problem to make my bar chart to be stacked

sideview — Sat, 01 Dec 2018 00:10:11 GMT

stats count by Logged_on, Type will give you what's sometimes called "stats style" output rows. This isn't what you want, and it can't really be "stacked".

What you want is chart count over Logged_on by Type, and this is called "chart style" output rows.

And last but not least, "chart style" rows can be stacked.

Further reading - sometimes in really advanced cases you need to kinda flip things around from one style of rows to another, and this is what xyseries and untable are for, if you've ever wondered. xyseries is an advanced command whose main purpose in life is to turn "stats style" output rows into "chart style" output rows, and untable does the opposite.

Re: Problem to make my bar chart to be stacked

qbolbk59 — Fri, 07 Dec 2018 09:56:37 GMT

Hi @sideview ... indeed. chart count by works fine for me. Thanks for the help.