topic Re: Stacked Bar Chart in Splunk Search

How can i create a stacked bar graph showing the different log levels?

sphiwee — Fri, 18 Aug 2023 18:11:35 GMT

How can i create a stacked bar graph showing the different log levels (Error, Info, Debug) generated by each Process

index="intau_workfusion" sourcetype=workfusion.out.log host=*
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)"
| search Log_level="*"
| where Process != ""

Re: Stacked Bar Chart

richgalloway — Fri, 18 Aug 2023 12:27:23 GMT

Charts require a command that produces statistics (chart, stats, timechart, etc.). Try this

index="intau_workfusion" sourcetype=workfusion.out.log host=* | rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)" | search Log_level="*" | where Process != "" | stats count by Log_level

Then switch to the Visualization tab, choose the Bar Chart visualization, then select the Stacked format.

Re: Stacked Bar Chart

sphiwee — Fri, 18 Aug 2023 13:04:52 GMT

I have applied it but but its only showin like this, I want the log level to be stacked and to show according to Process

Re: Stacked Bar Chart

richgalloway — Fri, 18 Aug 2023 15:50:58 GMT

Try using the chart command to get both Log_level and Process in the output.

To see the chart, switch to the Visualization tab, choose the "Column Chart" visualization, then select "Stacked" from the Format dropdown. See the example below.