Stacked Bar Using Pivot

[ShaneNewman]

Is there a way to create a report similar to a stacked bar timechart using the pivot model?

[somesoni2 · Accepted solution]

Will this work? (based on Splunk's sample data model internal_server)

<dashboard>
  <label>StackedPivot</label>
  <row>
    <chart>
      <searchString>| pivot internal_server server count(sourcetype) AS "Count" SPLITROW _time AS "_time" PERIOD minute SPLITCOL sourcetype SORT 0 _time NUMCOLS 100</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisTitleY.text">Count</option>
      <option name="charting.legend.placement">right</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.chart">bar</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
    </chart>
  </row>
</dashboard>

[helge]

So the trick is to splitrow by _time and splitcol by what you want stacked. Thanks for shraring!

[somesoni2]

End users can use the pivot search in Search app and selecting required visualization options. Same can be done from the Pivot (create/update) view. (this code is the saved pivot report from Pivot view)

[ShaneNewman]

It will in a dashboard view, I am trying to figure out if I can let end users do it in the Pivot panel...