https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271517#M81745 <P>The search is <CODE>index=_internal |timechart count by sourcetype</CODE>, the entire chart configuration is described above already.</P> Thu, 31 Mar 2016 21:20:33 GMT martin_mueller 2016-03-31T21:20:33Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271514#M81742 <P>I have a chart with 4 series and what I am wondering is "can I have a chart overlay with 2 series stacked in a Splunk graph"?</P> <P>For example can I get the 2 lines(red and purple) in the below graph stacked in the chart overlay<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1191i2F6567DB21F696A7/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>this is what I am trying to achieve in excel <BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1192iAD07493FC8268EEA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 31 Mar 2016 20:45:54 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271514#M81742 HattrickNZ 2016-03-31T20:45:54Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271515#M81743 <P>Sure: Select bar chart, select stacked mode, put your two overlay serieses into the chart overlay fields, done.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1189iE5A0F7C7CD42BDEB/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 31 Mar 2016 21:00:48 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271515#M81743 martin_mueller 2016-03-31T21:00:48Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271516#M81744 <P>thats what I thought. not working on my data. can I just confirm that you know that splunkd and splunkd_ui_access are stacked there? Can I have the search to see if i can reproduce at my end? tks </P> Tue, 29 Sep 2020 09:16:47 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271516#M81744 HattrickNZ 2020-09-29T09:16:47Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271517#M81745 <P>The search is <CODE>index=_internal |timechart count by sourcetype</CODE>, the entire chart configuration is described above already.</P> Thu, 31 Mar 2016 21:20:33 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271517#M81745 martin_mueller 2016-03-31T21:20:33Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271518#M81746 <P>checked that with my different data set and pretty sure they are not stacked. hard to confim with my dataset, </P> <P>In your example above I think splunkd and splunkd_ui_access are not stacked.I am not sure but if they were splunkd(the green line) would jump up when splunkd_ui_access jumps up(around 10.55pm). thoughts?</P> Tue, 29 Sep 2020 09:16:50 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271518#M81746 HattrickNZ 2020-09-29T09:16:50Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271519#M81747 <P>Chart overlays are not stacked, on purpose.</P> <P>With a bit of postprocessing you could compute the height of the stacked bars for each row, and add this offset to the overlay fields to emulate this behaviour.</P> Thu, 31 Mar 2016 22:20:37 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271519#M81747 martin_mueller 2016-03-31T22:20:37Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271520#M81748 <P>Like this:</P> <PRE><CODE>index=_internal |timechart span=1m count by sourcetype | addtotals | eval splunkd_ui_access = Total - splunkd | eval splunkd = Total | fields - Total </CODE></PRE> <P><IMG src="https://community.splunk.com/storage/temp/120197-overlay2.png" alt="alt text" /></P> <P>Note how the mongod bar bumps up both lines, and how the splunkd_ui_access line bumps up the splunkd line towards the right. Alter the arithmetic if that's not what you're looking for.</P> Tue, 29 Sep 2020 09:16:53 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271520#M81748 martin_mueller 2020-09-29T09:16:53Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271521#M81749 <P>why didn't you say so <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> tks. Ill look at doing some preprcessing or as I like to call it fiddling <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> But I do think it would be good as an option to be able to stack the chartoverlay, in my case here I am trying to do it on the 2nd y axis, my 2 cents.</P> Thu, 31 Mar 2016 22:29:26 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271521#M81749 HattrickNZ 2016-03-31T22:29:26Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271522#M81750 <P>tks, kind of but slightly different. have got mie sorted for now.</P> Thu, 31 Mar 2016 22:35:19 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271522#M81750 HattrickNZ 2016-03-31T22:35:19Z https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271523#M81751 <P>Can I have a chart overlay with 2 series stacked in a Splunk graph?</P> <P>thanks to @martin_mueller in the above comments. this is the answer.<BR /> Chart overlays are not stacked, on purpose.</P> <P>With a bit of postprocessing you could compute the height of the stacked bars for each row, and add this offset to the overlay fields to emulate this behaviour.</P> Sun, 03 Apr 2016 22:41:42 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-have-a-chart-overlay-with-2-series-stacked-in-a-Splunk/m-p/271523#M81751 HattrickNZ 2016-04-03T22:41:42Z