Dashboards & Visualizations

Area chart blank in stacked mode, but works fine in not stacked mode

hrecker
New Member

I'm having a strange issue with area chart. I have a search I've created an area chart for, which works fine, but when I edit the visualization to use either "stacked" or "stacked 100%" mode the whole chart disappears. This happens both in search and in the dashboard panel I made using the chart. If I return it to the default "not stacked" mode the chart comes back just fine.

I'm running splunk enterprise in a docker container right now, so I tried killing the container and starting a new one, and the issue went away. But I'd like to know if there is something that could typically cause this problem.

0 Karma

brschaefer_splu
Splunk Employee
Splunk Employee

Can you share your search? Generally this happens with tables that don't align to how Splunk expects the data.

0 Karma

hrecker
New Member

Here's the search, it seems pretty straightforward as far as I can tell. And I'm not sure why the chart would work in non-stacked mode with the exact same data.

sourcetype="statcsv" | rename "Add Ops" as Add, "Bind Ops" as Bind, "Compare Ops" as Compare, "Delete Ops" as Delete, "Modify Ops" as Modify, "Search Ops" as Search | table _time, Add, Bind, Compare, Delete, Modify, Search

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...