topic Re: Stacked Bar Using Pivot in Reporting

Stacked Bar Using Pivot

ShaneNewman — Fri, 11 Apr 2014 17:09:24 GMT

Is there a way to create a report similar to a stacked bar timechart using the pivot model?

Re: Stacked Bar Using Pivot

somesoni2 — Fri, 11 Apr 2014 18:36:46 GMT

Will this work? (based on Splunk's sample data model internal_server)

<dashboard>
  <label>StackedPivot</label>
  <row>
    <chart>
      <searchString>| pivot internal_server server count(sourcetype) AS "Count" SPLITROW _time AS "_time" PERIOD minute SPLITCOL sourcetype SORT 0 _time NUMCOLS 100</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisTitleY.text">Count</option>
      <option name="charting.legend.placement">right</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.chart">bar</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
    </chart>
  </row>
</dashboard>

Re: Stacked Bar Using Pivot

ShaneNewman — Fri, 11 Apr 2014 18:39:01 GMT

It will in a dashboard view, I am trying to figure out if I can let end users do it in the Pivot panel...

Re: Stacked Bar Using Pivot

somesoni2 — Fri, 11 Apr 2014 19:28:53 GMT

End users can use the pivot search in Search app and selecting required visualization options. Same can be done from the Pivot (create/update) view. (this code is the saved pivot report from Pivot view)

Re: Stacked Bar Using Pivot

helge — Sun, 08 Mar 2015 22:49:13 GMT

So the trick is to splitrow by _time and splitcol by what you want stacked. Thanks for shraring!