Dashboards & Visualizations

Area chart blank in stacked mode, but works fine in not stacked mode

hrecker
New Member

I'm having a strange issue with area chart. I have a search I've created an area chart for, which works fine, but when I edit the visualization to use either "stacked" or "stacked 100%" mode the whole chart disappears. This happens both in search and in the dashboard panel I made using the chart. If I return it to the default "not stacked" mode the chart comes back just fine.

I'm running splunk enterprise in a docker container right now, so I tried killing the container and starting a new one, and the issue went away. But I'd like to know if there is something that could typically cause this problem.

0 Karma

brschaefer_splu
Splunk Employee
Splunk Employee

Can you share your search? Generally this happens with tables that don't align to how Splunk expects the data.

0 Karma

hrecker
New Member

Here's the search, it seems pretty straightforward as far as I can tell. And I'm not sure why the chart would work in non-stacked mode with the exact same data.

sourcetype="statcsv" | rename "Add Ops" as Add, "Bind Ops" as Bind, "Compare Ops" as Compare, "Delete Ops" as Delete, "Modify Ops" as Modify, "Search Ops" as Search | table _time, Add, Bind, Compare, Delete, Modify, Search

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...