Splunk Search

Creating a stacked bar chart

BearMormont
Path Finder

I feel silly asking this question as I think it should be relatively straight forward, but I am not able to get the following search query into a dashboard to display as a stacked bar chart.

I have a search that produces the following table output:

Status                    TotalCount
Ready                     800
Not Ready                 200

What I would like is to display this a stacked barchart 1000 units long with Ready 800 of them and the Not Ready the remaining 200.

Could someone point me in the right direction?

Thanks,
Matt

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Stacked bar charts expect a two-dimensional table, not just a one-dimensional list: One dimension for the x-axis, another dimension for the colour-axis.

To turn your list into such a table, you'll need to create a single-valued dummy dimension and then rotate the table like this:

... | eval Value = "Count by Status" | xyseries Value Status TotalCount

Depending on how you generated your list, you might be able to change that search to directly come up with a result that looks like this:

Value              NotReady     Ready
Count by Status         200       800

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Stacked bar charts expect a two-dimensional table, not just a one-dimensional list: One dimension for the x-axis, another dimension for the colour-axis.

To turn your list into such a table, you'll need to create a single-valued dummy dimension and then rotate the table like this:

... | eval Value = "Count by Status" | xyseries Value Status TotalCount

Depending on how you generated your list, you might be able to change that search to directly come up with a result that looks like this:

Value              NotReady     Ready
Count by Status         200       800
0 Karma

BearMormont
Path Finder

Thanks!

Worked great.

0 Karma
Get Updates on the Splunk Community!

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...