Dashboards & Visualizations

How to group stacked bar chart by a value?

KalebeRS
Explorer

Hello,

 

I have the following code for a bar chart that I need to show stacked the results from the 3 ifs that I have. The code retrieves data by week number and divides then by each day of the week.

Is it possible to group the data by week number showing each result for the day of the week stacked by the results of the 3 if's that I have?

index="" host= sourcetype=csv [search index="" host= sourcetype=csv source=C:\\2023-CW28_2.csv | dedup source | table source | sort - source | head 1 ] 
| table iswID, iswTitle, iswSD, pverID, pverSF
| where iswSD >= strftime(relative_time(now(), "-3w@w"),"%Y-%m-%d")
| eval Week=strftime(strptime(iswSD,"%Y-%m-%d"),"%V")
| eval Day=strftime(strptime(iswSD,"%Y-%m-%d"),"%A")
| eval ISWGT=if(iswSD>pverSF,1,0)
| eval ISWLE=if(iswSD<=pverSF,1,0)
| eval non_mapped= if(match(pverID,""), 1,0)
| chart sum(ISWGT) as "iswSD gt pverSF", sum(ISWLE) as "iswSD LE pverSF", sum(non_mapped) as "Non Mapped" by Week,Day

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The simple answer is no.

A bar chart has three things, an x-axis, a y-axis, and a set of series of data. For a stacked chart, each series is stacked according to its x-axis label and its y-axis value.

You appear to have four things, week, day, "if" name, and "if" sum.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...