Reporting

Stacked Bar Using Pivot

ShaneNewman
Motivator

Is there a way to create a report similar to a stacked bar timechart using the pivot model?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Will this work? (based on Splunk's sample data model internal_server)

<dashboard>
  <label>StackedPivot</label>
  <row>
    <chart>
      <searchString>| pivot internal_server server count(sourcetype) AS "Count" SPLITROW _time AS "_time" PERIOD minute SPLITCOL sourcetype SORT 0 _time NUMCOLS 100</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisTitleY.text">Count</option>
      <option name="charting.legend.placement">right</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.chart">bar</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
    </chart>
  </row>
</dashboard>

View solution in original post

somesoni2
Revered Legend

Will this work? (based on Splunk's sample data model internal_server)

<dashboard>
  <label>StackedPivot</label>
  <row>
    <chart>
      <searchString>| pivot internal_server server count(sourcetype) AS "Count" SPLITROW _time AS "_time" PERIOD minute SPLITCOL sourcetype SORT 0 _time NUMCOLS 100</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisTitleY.text">Count</option>
      <option name="charting.legend.placement">right</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.chart">bar</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
    </chart>
  </row>
</dashboard>

helge
Builder

So the trick is to splitrow by _time and splitcol by what you want stacked. Thanks for shraring!

0 Karma

somesoni2
Revered Legend

End users can use the pivot search in Search app and selecting required visualization options. Same can be done from the Pivot (create/update) view. (this code is the saved pivot report from Pivot view)

ShaneNewman
Motivator

It will in a dashboard view, I am trying to figure out if I can let end users do it in the Pivot panel...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...