Dashboards & Visualizations

Chart problems : Stacked 2 values by users over several months

mb1226
Explorer

We've had several changes going on to some dashboards I've been doing, including new data.  Where we used to be dealing with only PRD data, we're adding some TST data activity as well.   The chart I'm trying to do is a to show counts of activity by PRD and TST, stacked, for each of our 3 current users over the last 7 months.  We want an at a glance view of how much work is being done, by whom and where, and how one user compares to the other.   I can do it as separate charts, but it can be confusing.    1 person's count scale peaks at 25 where the other peaks at 66, so if you don't look at the fine print, User A doesn't look like they are doing a third of the work of User B.    

I've tried several variations of charts, timecharts, etc., but either they don't work, combine PRD/TST into one total or they don't stack.  

Best result for me would be one column (or bar if need be) per user per month, with two separate totals for PRD and TST counts, stacked on each other.       

0 Karma
1 Solution

johnhuang
Motivator

The closest you can do is combine both user and environment into one field:

| makeresults | eval name="Ana,Joe,Rob", env="PRD,TST", date="1-1-2022,2-1-2022,3-1-2022,4-1-2022,5-1-2022,6-1-2022,7-1-2022,8-1-2022"
| foreach * [| eval <<FIELD>>=SPLIT(<<FIELD>>, ",") | mvexpand <<FIELD>> | eval event_ct=(random() % 30) + 1]
| eval _time=strptime(date, "%m-%d-%Y")
| eval event_name="[".env."] - ".name
| timechart span=1mon sum(event_ct) AS event_ct BY event_name

 

johnhua_0-1666639195772.png

 

View solution in original post

johnhuang
Motivator

The closest you can do is combine both user and environment into one field:

| makeresults | eval name="Ana,Joe,Rob", env="PRD,TST", date="1-1-2022,2-1-2022,3-1-2022,4-1-2022,5-1-2022,6-1-2022,7-1-2022,8-1-2022"
| foreach * [| eval <<FIELD>>=SPLIT(<<FIELD>>, ",") | mvexpand <<FIELD>> | eval event_ct=(random() % 30) + 1]
| eval _time=strptime(date, "%m-%d-%Y")
| eval event_name="[".env."] - ".name
| timechart span=1mon sum(event_ct) AS event_ct BY event_name

 

johnhua_0-1666639195772.png

 

mb1226
Explorer

I've tried something similar, but not exactly like that.   It is better than what I have now.   I'm thinking of adding counts to the values and have a careful color list so that one user is greens, another blues, the third reds.    Done this so it is easy to see which values belong to who, and you don't have to mouse over to get exact counts. 

Thanks

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...