Archive
Highlighted

Struggling with stacked bar chart to show time spent in different places

Path Finder

Hi,

We are trying to use Splunk to provide some nice diagrams showing execution time of critical sections in reference to total execution time.

Let's say this is our input:

   Type ="Perf"  Section="TOTAL" FlowType="F1" RequestType="R1" Time="23"
    Type="Perf" Section="A" FlowType="F1" RequestType="R1" Time="3"
    Type="Perf" Section="B" FlowType="F1" RequestType="R1" Time="13"
    Type="Perf" Section="TOTAL" FlowType="F2" RequestType="R2" Time="45"
    Type="Perf" Section="A" FlowType="F2" RequestType="R2" Time="30"
    Type="Perf" Section="B" FlowType="F2" RequestType="R2" Time="3"

What we would like to have is a stacked bar chart, which will be high as value in Total and inside will have a bar for each Section and the difference will shown as OTHER (in case of first 3 rows OTHER = 7)

So the y axis is time and the x axis is FlowType + RequestType. I am trying different queries but could not get anything yet... any ideas?

This is hwat I got so far:

source | where Type="Perf" | 
stats avg(Time) as AvgTime sum(Time) as Time values(Section) as SectionName by Section FlowType RequestType |
eval Reference = "(".FlowType."-".SectionType.")" |
eventstats avg(Time) as "AvgSectionTime" by FlowType RequestType SectionName |
chart values(AvgSectionTime) as Time over Reference by SectionName

This is not resolving all the issues, but it generates the stacked bar chart.

Best regards,
Michal

0 Karma
Highlighted

Re: Struggling with stacked bar chart to show time spent in different places

SplunkTrust
SplunkTrust

Try something like this

 source | where Type="Perf" | eval Reference = "(".FlowType."-".SectionType.")" | chart sum(Time) as Time over Reference by SectionName | addtotals fieldname=OTHER | eval OTHER=2*Total - OTHER | fields - Total | table Reference * OTHER

View solution in original post

0 Karma
Highlighted

Re: Struggling with stacked bar chart to show time spent in different places

Path Finder

Hi,

Clever!

Also I didn't know that I can directly call fields in eval (e.g. ... | eval SUM = A + B). How I have missed that? This simplified the things a lot!

Thanks!

0 Karma