Archive
Highlighted

Area chart blank in stacked mode, but works fine in not stacked mode

New Member

I'm having a strange issue with area chart. I have a search I've created an area chart for, which works fine, but when I edit the visualization to use either "stacked" or "stacked 100%" mode the whole chart disappears. This happens both in search and in the dashboard panel I made using the chart. If I return it to the default "not stacked" mode the chart comes back just fine.

I'm running splunk enterprise in a docker container right now, so I tried killing the container and starting a new one, and the issue went away. But I'd like to know if there is something that could typically cause this problem.

0 Karma
Highlighted

Re: Area chart blank in stacked mode, but works fine in not stacked mode

Splunk Employee
Splunk Employee

Can you share your search? Generally this happens with tables that don't align to how Splunk expects the data.

0 Karma
Highlighted

Re: Area chart blank in stacked mode, but works fine in not stacked mode

New Member

Here's the search, it seems pretty straightforward as far as I can tell. And I'm not sure why the chart would work in non-stacked mode with the exact same data.

sourcetype="statcsv" | rename "Add Ops" as Add, "Bind Ops" as Bind, "Compare Ops" as Compare, "Delete Ops" as Delete, "Modify Ops" as Modify, "Search Ops" as Search | table _time, Add, Bind, Compare, Delete, Modify, Search

0 Karma