topic Re: How do I create a stacked bar graph with 2 fields? in Splunk Search

How do I create a stacked bar graph with 2 fields?

jhoang — Tue, 12 Jan 2016 20:33:11 GMT

Hi,

I am trying to create a stacked bar graph, using 2 fields.

First field is Level, second field is Urgency. I want to sort the columns based on Level, and displaying the number of different Urgency in the stacked column. See below, the long column would show 2 critical items, 1 high, and 1 medium items, for a total of 4 items.

Level Urgency
Long Critical
Long Critical
Long High
Long Medium
Medium High
Medium Low
Medium Low
Medium Low

Re: How do I create a stacked bar graph with 2 fields?

jhoang — Tue, 12 Jan 2016 21:37:10 GMT

Note - this is for year to date data. Is it possible to display this without using the timechart option ?

Re: How do I create a stacked bar graph with 2 fields?

somesoni2 — Tue, 12 Jan 2016 21:44:20 GMT

Try something like this

your search giving above output (two fields) | chart count over Level by Urgency

Select the appropriate option in the visualization to create stacked chart.

Re: How do I create a stacked bar graph with 2 fields?

jhoang — Tue, 12 Jan 2016 21:48:50 GMT

Thank you brother!!!!

Re: How do I create a stacked bar graph with 2 fields?

arbelron3 — Mon, 04 Jul 2016 07:10:55 GMT

hey,
I tried and I dont get a graph for each Urgency but a seperated values... it erases some of the points... does someone know why and how I correct it ?