Dashboards & Visualizations

Chart problems : Stacked 2 values by users over several months

mb1226
Explorer

We've had several changes going on to some dashboards I've been doing, including new data.  Where we used to be dealing with only PRD data, we're adding some TST data activity as well.   The chart I'm trying to do is a to show counts of activity by PRD and TST, stacked, for each of our 3 current users over the last 7 months.  We want an at a glance view of how much work is being done, by whom and where, and how one user compares to the other.   I can do it as separate charts, but it can be confusing.    1 person's count scale peaks at 25 where the other peaks at 66, so if you don't look at the fine print, User A doesn't look like they are doing a third of the work of User B.    

I've tried several variations of charts, timecharts, etc., but either they don't work, combine PRD/TST into one total or they don't stack.  

Best result for me would be one column (or bar if need be) per user per month, with two separate totals for PRD and TST counts, stacked on each other.       

0 Karma
1 Solution

johnhuang
Motivator

The closest you can do is combine both user and environment into one field:

| makeresults | eval name="Ana,Joe,Rob", env="PRD,TST", date="1-1-2022,2-1-2022,3-1-2022,4-1-2022,5-1-2022,6-1-2022,7-1-2022,8-1-2022"
| foreach * [| eval <<FIELD>>=SPLIT(<<FIELD>>, ",") | mvexpand <<FIELD>> | eval event_ct=(random() % 30) + 1]
| eval _time=strptime(date, "%m-%d-%Y")
| eval event_name="[".env."] - ".name
| timechart span=1mon sum(event_ct) AS event_ct BY event_name

 

johnhua_0-1666639195772.png

 

View solution in original post

johnhuang
Motivator

The closest you can do is combine both user and environment into one field:

| makeresults | eval name="Ana,Joe,Rob", env="PRD,TST", date="1-1-2022,2-1-2022,3-1-2022,4-1-2022,5-1-2022,6-1-2022,7-1-2022,8-1-2022"
| foreach * [| eval <<FIELD>>=SPLIT(<<FIELD>>, ",") | mvexpand <<FIELD>> | eval event_ct=(random() % 30) + 1]
| eval _time=strptime(date, "%m-%d-%Y")
| eval event_name="[".env."] - ".name
| timechart span=1mon sum(event_ct) AS event_ct BY event_name

 

johnhua_0-1666639195772.png

 

mb1226
Explorer

I've tried something similar, but not exactly like that.   It is better than what I have now.   I'm thinking of adding counts to the values and have a careful color list so that one user is greens, another blues, the third reds.    Done this so it is easy to see which values belong to who, and you don't have to mouse over to get exact counts. 

Thanks

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...