https://community.splunk.com/t5/Splunk-Search/Struggling-with-stacked-bar-chart-to-show-time-spent-in/m-p/237759#M188660 <P>Try something like this</P> <PRE><CODE> source | where Type="Perf" | eval Reference = "(".FlowType."-".SectionType.")" | chart sum(Time) as Time over Reference by SectionName | addtotals fieldname=OTHER | eval OTHER=2*Total - OTHER | fields - Total | table Reference * OTHER </CODE></PRE> Tue, 08 Mar 2016 17:24:31 GMT somesoni2 2016-03-08T17:24:31Z https://community.splunk.com/t5/Splunk-Search/Struggling-with-stacked-bar-chart-to-show-time-spent-in/m-p/237758#M188659 <P>Hi,</P> <P>We are trying to use Splunk to provide some nice diagrams showing execution time of critical sections in reference to total execution time.</P> <P>Let's say this is our input:</P> <PRE><CODE> Type ="Perf" Section="TOTAL" FlowType="F1" RequestType="R1" Time="23" Type="Perf" Section="A" FlowType="F1" RequestType="R1" Time="3" Type="Perf" Section="B" FlowType="F1" RequestType="R1" Time="13" Type="Perf" Section="TOTAL" FlowType="F2" RequestType="R2" Time="45" Type="Perf" Section="A" FlowType="F2" RequestType="R2" Time="30" Type="Perf" Section="B" FlowType="F2" RequestType="R2" Time="3" </CODE></PRE> <P>What we would like to have is a stacked bar chart, which will be high as value in Total and inside will have a bar for each Section and the difference will shown as OTHER (in case of first 3 rows OTHER = 7)</P> <P>So the y axis is time and the x axis is FlowType + RequestType. I am trying different queries but could not get anything yet... any ideas?</P> <P>This is hwat I got so far:</P> <PRE><CODE>source | where Type="Perf" | stats avg(Time) as AvgTime sum(Time) as Time values(Section) as SectionName by Section FlowType RequestType | eval Reference = "(".FlowType."-".SectionType.")" | eventstats avg(Time) as "AvgSectionTime" by FlowType RequestType SectionName | chart values(AvgSectionTime) as Time over Reference by SectionName </CODE></PRE> <P>This is not resolving all the issues, but it generates the stacked bar chart.</P> <P>Best regards,<BR /> Michal</P> Tue, 08 Mar 2016 13:04:20 GMT https://community.splunk.com/t5/Splunk-Search/Struggling-with-stacked-bar-chart-to-show-time-spent-in/m-p/237758#M188659 PanKokos 2016-03-08T13:04:20Z https://community.splunk.com/t5/Splunk-Search/Struggling-with-stacked-bar-chart-to-show-time-spent-in/m-p/237759#M188660 <P>Try something like this</P> <PRE><CODE> source | where Type="Perf" | eval Reference = "(".FlowType."-".SectionType.")" | chart sum(Time) as Time over Reference by SectionName | addtotals fieldname=OTHER | eval OTHER=2*Total - OTHER | fields - Total | table Reference * OTHER </CODE></PRE> Tue, 08 Mar 2016 17:24:31 GMT https://community.splunk.com/t5/Splunk-Search/Struggling-with-stacked-bar-chart-to-show-time-spent-in/m-p/237759#M188660 somesoni2 2016-03-08T17:24:31Z https://community.splunk.com/t5/Splunk-Search/Struggling-with-stacked-bar-chart-to-show-time-spent-in/m-p/237760#M188661 <P>Hi,</P> <P>Clever! </P> <P>Also I didn't know that I can directly call fields in eval (e.g. ... | eval SUM = A + B). How I have missed that? This simplified the things a lot! </P> <P>Thanks!</P> Wed, 09 Mar 2016 15:05:33 GMT https://community.splunk.com/t5/Splunk-Search/Struggling-with-stacked-bar-chart-to-show-time-spent-in/m-p/237760#M188661 PanKokos 2016-03-09T15:05:33Z