https://community.splunk.com/t5/Splunk-Search/How-to-create-stacked-bar-chart-for-http-https/m-p/11517#M796 <P>is it possible to do a stacked bar chart where it splits it in two to show how much is https requests and how much is http requests?</P> Thu, 15 Apr 2010 00:56:06 GMT jrich523 2010-04-15T00:56:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-stacked-bar-chart-for-http-https/m-p/11517#M796 <P>is it possible to do a stacked bar chart where it splits it in two to show how much is https requests and how much is http requests?</P> Thu, 15 Apr 2010 00:56:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-stacked-bar-chart-for-http-https/m-p/11517#M796 jrich523 2010-04-15T00:56:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-stacked-bar-chart-for-http-https/m-p/11518#M797 <P>You must make sure you have an extraction on your data to differentiate the two, but you would simply do:</P> <PRE><CODE>sourcetype=whatever | chart count by ssl_type </CODE></PRE> <P>where ssl_type might be the field that contains, say, the inbound port number or a search-time extraction of the incoming URL request, assuming that is logged.</P> Thu, 15 Apr 2010 01:03:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-stacked-bar-chart-for-http-https/m-p/11518#M797 gkanapathy 2010-04-15T01:03:50Z https://community.splunk.com/t5/Splunk-Search/How-to-create-stacked-bar-chart-for-http-https/m-p/11519#M798 <P>Try this search:</P> <P>sourcetype=whatever | chart count(ssl_type) over protocol by ssl_type</P> Thu, 15 Apr 2010 09:43:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-stacked-bar-chart-for-http-https/m-p/11519#M798 BunnyHop 2010-04-15T09:43:51Z