topic Creating a stacked bar chart in Splunk Search

Creating a stacked bar chart

BearMormont — Sat, 24 Feb 2018 21:57:29 GMT

I feel silly asking this question as I think it should be relatively straight forward, but I am not able to get the following search query into a dashboard to display as a stacked bar chart.

I have a search that produces the following table output:

Status                    TotalCount
Ready                     800
Not Ready                 200

What I would like is to display this a stacked barchart 1000 units long with Ready 800 of them and the Not Ready the remaining 200.

Could someone point me in the right direction?

Thanks,
Matt

Re: Creating a stacked bar chart

martin_mueller — Sat, 24 Feb 2018 23:14:07 GMT

Stacked bar charts expect a two-dimensional table, not just a one-dimensional list: One dimension for the x-axis, another dimension for the colour-axis.

To turn your list into such a table, you'll need to create a single-valued dummy dimension and then rotate the table like this:

... | eval Value = "Count by Status" | xyseries Value Status TotalCount

Depending on how you generated your list, you might be able to change that search to directly come up with a result that looks like this:

Value              NotReady     Ready
Count by Status         200       800

Re: Creating a stacked bar chart

BearMormont — Sat, 24 Feb 2018 23:38:24 GMT

Thanks!

Worked great.