Reporting

Stacked Bar Using Pivot

Motivator

Is there a way to create a report similar to a stacked bar timechart using the pivot model?

Tags (2)
0 Karma
1 Solution

Revered Legend

Will this work? (based on Splunk's sample data model internal_server)

<dashboard>
  <label>StackedPivot</label>
  <row>
    <chart>
      <searchString>| pivot internal_server server count(sourcetype) AS "Count" SPLITROW _time AS "_time" PERIOD minute SPLITCOL sourcetype SORT 0 _time NUMCOLS 100</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisTitleY.text">Count</option>
      <option name="charting.legend.placement">right</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.chart">bar</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
    </chart>
  </row>
</dashboard>

View solution in original post

Revered Legend

Will this work? (based on Splunk's sample data model internal_server)

<dashboard>
  <label>StackedPivot</label>
  <row>
    <chart>
      <searchString>| pivot internal_server server count(sourcetype) AS "Count" SPLITROW _time AS "_time" PERIOD minute SPLITCOL sourcetype SORT 0 _time NUMCOLS 100</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisTitleY.text">Count</option>
      <option name="charting.legend.placement">right</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.chart">bar</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
    </chart>
  </row>
</dashboard>

View solution in original post

Builder

So the trick is to splitrow by _time and splitcol by what you want stacked. Thanks for shraring!

0 Karma

Revered Legend

End users can use the pivot search in Search app and selecting required visualization options. Same can be done from the Pivot (create/update) view. (this code is the saved pivot report from Pivot view)

Motivator

It will in a dashboard view, I am trying to figure out if I can let end users do it in the Pivot panel...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!