topic stacked bar chart of sum of errorcodes by server in Splunk Search

stacked bar chart of sum of errorcodes by server

eddychuah — Fri, 20 Oct 2017 17:41:56 GMT

I'm trying to create 1 bar chart to kill 2 views, my search is as follows;

sourcetype="error log" severity=ERROR | top limit=10 error_code by host

and yields
host error_code count
app1 code0001 300
app1 code0002 171
app1 code0003 145
app2 code0001 546
app2 code0002 197
app2 code0003 146
app3 code0001 412
app3 code0002 168
app3 code0003 149

i am looking for a simple bar chart of error_code on Y-axis and count on X-axis however, the x-axis should be stacked so that i can see code001 broken down/chunked out into 3 sections of host#

please help

Re: stacked bar chart of sum of errorcodes by server

elliotproebstel — Fri, 20 Oct 2017 20:39:25 GMT

I think this should do the trick:
| chart values(count) AS count BY error_code host

Make sure your visualization is set to stacked mode (under Format).

Re: stacked bar chart of sum of errorcodes by server

eddychuah — Mon, 23 Oct 2017 13:21:15 GMT

thank you!!! works as intended!

am still trying to learn all the splunk graphing command fundamentals ^^