Splunk Enterprise

How to group/split stacked bar chart columns?

timo258
Explorer

Hi together,

I want to group my bar chart in 2 columns. In the pictures you can see how I get it done and how it should look.

reachedreachedtargettarget

 

host=my_host index=my_index
            | stats count
            | join 
                [ search host=my_host index=my_index result.value= -1
                | stats count 
                | rename count as "Tests_Failed"] 
            | join type=left
                [ search host=my_host index=my_index result.value= 1
                | stats count
                | rename count as "Tests_Passed"]
            | join
               [search host=my_host index=my_index
               | rename result.value as isFailed
               | eval isFailed=if(isFailed=-1, 0, 1)
               | stats sum(isFailed) as testedPositive by Produktionsnummer
               | stats count(eval(testedPositive!="0")) as io count(eval(testedPositive="0")) as nio]
            | table Typ-Nummer, Tests_Failed, Tests_Passed, nio, io
            | rename Typ-Nummer AS "Product Name & Number", Tests_Passed AS "Tests Passed", Tests_Failed AS "Tests Failed", percFailed as "Percentage of Tests Failed"

 

 

I want so split it in 2 stacked columns like on the picture (Tests_Failed, Tests_Passed) and (nio, io).

Many thanks in advance!

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...