topic Re: Create a triple stacked bar chart that has one column per day in Splunk Search

Create a triple stacked bar chart that has one column per day

SimonR2018 — Mon, 15 Jul 2019 03:47:20 GMT

Hello All,

I am having difficulty in creating a triple stacked bar chart that has is displayed per day for time series

I have 3 fields in accountDetails.channel consisting of 'iPhone, web, android' i.e
ANDROID 63
IPHONE 232
WEB 45

and what I want is to create a single column with each of these fields and values per day and then create a time series for the columns values for the previous X days

unfortunately while i can create a single bar with the total number of accounts created I can not stack the bar per X days

Re: Create a triple stacked bar chart that has one column per day

renjith_nair — Mon, 15 Jul 2019 06:21:53 GMT

@SimonR2018,

Try

spath event | search event="account:create:account:success"|dedup accountDetails.accountId 
| bin _time span=1d as day | convert timeformat="%Y-%m-%d" ctime(day) AS MYDay 
| chart count  over MYDay by accountDetails.channel

Re: Create a triple stacked bar chart that has one column per day

SimonR2018 — Mon, 15 Jul 2019 23:45:02 GMT

Thank you very much, working as requested