topic Re: STACKED area chart?? in Splunk Search

STACKED area chart??

a277437 — Wed, 04 Aug 2021 01:28:51 GMT

Will Splunk do a stacked area chart? I'm able to get an area chart, but it's not 'stacked' (so each proxy totals to an aggregate). I'm wondering if splunk can even do that? I looked at the documentation and it appeared that it could, so I'm hoping maybe I'm just doing something wrong. Under the 'Visualization"

index = "myindex"| bin _time span=5m
| stats sum(cs_bytes) as Bytes by proxy_server _time
| eval Kbps=(((Bytes*8)/1000)/300)
| timechart span=5m list(Kbps) by proxy_server

Re: STACKED area chart??

a277437 — Wed, 04 Aug 2021 01:30:00 GMT

Continuing from above... "Under the Visualization" I selected the area chart.

Thank you!

Re: STACKED area chart??

ITWhisperer — Wed, 04 Aug 2021 05:34:40 GMT

Change the format of the area chart to stacked

Re: STACKED area chart??

a277437 — Wed, 04 Aug 2021 15:05:03 GMT

That's it!!! Thank you!