Dashboards & Visualizations

How can I group time in buckets for stacked bar chart?

rkassabov
Path Finder

I have a simple query that produces a stacked bar chart as follows:

index=xxx
| table time, info_owner_deptBusiness, avg_data_residualRisk_max
| chart count(avg_data_residualRisk_max) over time by info_owner_deptBusiness

I would like to group my events by "time" in buckets of 5 minute intervals. My time stamps look like this:

2017-12-20T00:40:08.701+0000

How can I accomplish this while preserving the stacked bar chart visualization?

Tags (2)
0 Karma
1 Solution

mayurr98
Super Champion

Try this:

index=xxx 
| bin span=5m _time 
| chart count(avg_data_residualRisk_max) over _time by info_owner_deptBusiness

View solution in original post

mayurr98
Super Champion

Try this:

index=xxx 
| bin span=5m _time 
| chart count(avg_data_residualRisk_max) over _time by info_owner_deptBusiness

rkassabov
Path Finder

Perfect, thank you!

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...