https://community.splunk.com/t5/Splunk-Search/Formatting-a-Search-for-a-Stacked-Bar-Graph/m-p/32746#M6871 <P>I've been reading into the splunk documentation, but I'm having trouble formatting a search so that I can use it in a stacked bar graph</P> <P>Among other data, in this file, some events are logged as such:</P> <P><CODE><BR /> %timestamp% - UArateLimit userAgent="%userAgent%" COUNT=%count%</CODE></P> <P>Basically, for each day (there may be multiple logs for each useragent per day, so the final bar graph should have summed counts), I would like to stack the separate useragents and based on their counts. </P> <P>How can I set up the search so that this is is possible? Thanks!</P> Tue, 14 May 2013 13:55:38 GMT zachary_hickman 2013-05-14T13:55:38Z https://community.splunk.com/t5/Splunk-Search/Formatting-a-Search-for-a-Stacked-Bar-Graph/m-p/32746#M6871 <P>I've been reading into the splunk documentation, but I'm having trouble formatting a search so that I can use it in a stacked bar graph</P> <P>Among other data, in this file, some events are logged as such:</P> <P><CODE><BR /> %timestamp% - UArateLimit userAgent="%userAgent%" COUNT=%count%</CODE></P> <P>Basically, for each day (there may be multiple logs for each useragent per day, so the final bar graph should have summed counts), I would like to stack the separate useragents and based on their counts. </P> <P>How can I set up the search so that this is is possible? Thanks!</P> Tue, 14 May 2013 13:55:38 GMT https://community.splunk.com/t5/Splunk-Search/Formatting-a-Search-for-a-Stacked-Bar-Graph/m-p/32746#M6871 zachary_hickman 2013-05-14T13:55:38Z https://community.splunk.com/t5/Splunk-Search/Formatting-a-Search-for-a-Stacked-Bar-Graph/m-p/32747#M6872 <P>I think you are looking for something like below, based on your data, with 'count' and 'useragent' being your fields. </P> <PRE><CODE>&lt;your search&gt; | bucket _time span=1d |stats count(Count) by userAgent </CODE></PRE> Tue, 14 May 2013 14:21:59 GMT https://community.splunk.com/t5/Splunk-Search/Formatting-a-Search-for-a-Stacked-Bar-Graph/m-p/32747#M6872 sdaniels 2013-05-14T14:21:59Z