Dashboards & Visualizations

RatioBar Example Usage

srepetsk
New Member

I'm fairly inexperienced with writing complex charting XML in Splunk, and I'd like to see if anyone has an example for how to use RatioBar graphs. I'd like to create a graph of the count of all events over time, with the bars splitting out into the ratio of which hosts they came from (perhaps limiting to the top 5 or something). Thanks in advance

Tags (2)
0 Karma
1 Solution

BobM
Builder

The easiest way to do this is in the advanced charting view.

Search app >> views >> advanced charting

... | timechart count by <field> limit=5 useother=f

Set chart type to "column" and stack mode to "stacked" or "100% stacked" if you prefer.

View solution in original post

BobM
Builder

The easiest way to do this is in the advanced charting view.

Search app >> views >> advanced charting

... | timechart count by <field> limit=5 useother=f

Set chart type to "column" and stack mode to "stacked" or "100% stacked" if you prefer.

srepetsk
New Member

Excellent! Thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...