topic Re: Expanded stacked column chart in Splunk Search

Expanded stacked column chart

tmortiboy — Thu, 29 Jun 2017 05:47:14 GMT

Is it possible to create a column chart that is stacked, but where each part of the stack still occupies its own column?

As Image below:

Re: Expanded stacked column chart

HiroshiSatoh — Thu, 29 Jun 2017 06:32:15 GMT

This is an idea.

Change the color of the bar
subtotal->White

＜Search＞

...|stats count by method|eval subtotal=count| accum subtotal|eval subtotal=subtotal-count|sort - method

＜XML＞

<option name="charting.legend.labels">[count,subtotal]</option>
<option name="charting.seriesColors">[0xFF0000,0xFFFFFF]</option>

Re: Expanded stacked column chart

tmortiboy — Thu, 29 Jun 2017 06:59:26 GMT

I had thought of this, but the subtotals can still be hovered over, which is less than ideal.
Unless you know how you can disable the hover for this value?

Re: Expanded stacked column chart

cmerriman — Thu, 29 Jun 2017 11:37:45 GMT

if you're comfortable creating a custom viz, you might be able to use this as a starter:
https://www.highcharts.com/demo/waterfall/grid-light

also this app has a waterfall viz, but the last supported version is 6.4
https://splunkbase.splunk.com/app/2856/

Re: Expanded stacked column chart

tmortiboy — Tue, 04 Jul 2017 04:14:38 GMT

I ended up using this method, but it still feels a little hacky.

Re: Expanded stacked column chart

niketn — Wed, 09 Aug 2017 05:39:08 GMT

@tmortiboy, I have created Waterfall visualization using D3 and Splunk's Custom Visualization API. Please check it out whether it fits the need: https://splunkbase.splunk.com/app/3669/

PS: I currently have not implemented the following:
1) Tooltip (currently static label can be displayed)
2) Drilldown
3) Dynamic size (it is manual based on chart height/width right now)
4) Negative axis (can be implemented only after dynamic size is in place)