topic Adding a predicted cumulative value to a stacked bar chart in Splunk Search

Adding a predicted cumulative value to a stacked bar chart

rbolande — Wed, 30 Dec 2020 22:23:09 GMT

I wish to take a stacked bar chart, use 'addtotals' to create a field representing the cumulative value of the stacked bars, and then overlay a prediction (using predict) of the cumulative value on the stacked bar chart. When I try to do this, the stacked bars always revert to side-by-side in the chart. Here is a look at what I wish to do:

some SPL that generates a sample dataset:

If I create a visualization of this, stack the bars, and add the 'load_total' field as an overlay, I end up with something like this:

Now, I wish to add 'predict' to this query to get forecasted values for the cumulative 'load_total' field. Here is the SPL for that:

Even though the bars are set to be stacked in the format of the chart, they revert to side-by-side.

Any ideas on why the behavior is like this or how I can get the stacked bars?

I believe what I am trying to do is the same as in this post from @renuka , but I wanted to add a little more information.

Thanks,

Reid

Re: Adding a predicted cumulative value to a stacked bar chart

to4kawa — Wed, 30 Dec 2020 22:43:56 GMT

We need to make the display look like this.

Re: Adding a predicted cumulative value to a stacked bar chart

rbolande — Thu, 31 Dec 2020 15:13:07 GMT

@to4kawa - Thanks for the response. Your proposed solution does give me a workaround of sorts (we are currently using something like this). Here is what the visual looks like:

I am really hoping to get a visual that maintains the "normal" predict confidence level shaded area...with the stacked bars. Something like this, except with stacked bars:

Is there a technical reason that we can't maintain stacked bars while also preserving the shading of the confidence envelope?

Thanks,

REID

Re: Adding a predicted cumulative value to a stacked bar chart

rbolande — Mon, 01 Feb 2021 13:38:55 GMT

After consulting with Splunk Support and our Splunk Sales Engineer, I have submitted a request for using PREDICT with stacked bars on https://ideas.splunk.com/ideas/EID-I-807

The desired functionality does not seem possible in current versions of Splunk.