Creating a stacked line chart / timechart

[kenbaugher]

We have data similar to below and are looking to created a stacked timechart, however setting the stackmode does not seem to have any impact on the chart

timestamp System Value
TIME1 SYS1 VALUE1.1
TIME1 SYS2 VALUE2.1
TIME1 SYS3 VALUE3.1
TIME1 SYS4 VALUE4.1
TIME2 SYS1 VALUE1.2
TIME2 SYS2 VALUE2.2
TIME2 SYS3 VALUE3.2
TIME2 SYS4 VALUE4.2

timechart latest(Value) by System

<option name="charting.chart.stackMode">stacked</option>

[ITWhisperer]

Stacked mode is not a valid option for line charts - try column charts

[kenbaugher]

On one hand thank you very much, changing this to a column makes the stacked work.   On the other hand the documentation I was reading did list the stackmode under line charts, so that is a bit confusing.

Chart configuration reference - Splunk Documentation

The teams would prefer the line graphs as that is more common for us, but this does get the desired visual.

Thank you

[ITWhisperer · Accepted solution]

You could consider area charts which sort of mixes line and column charts