Splunk Search

How can I make a stacked Column chart?

Edwin1471
Path Finder

Hi, 

how can I make a stacked column chart . Currently the Purple area displays how long it took for all processes combined to execute. How could I modify my spl query so that it would display how long each individual process took to complete in a column chart.    (A1, A2, A3 - process names)

Edwin1471_0-1659601687145.pngEdwin1471_1-1659601918657.png

 

| rex field=PROCESS_NAME ":(?<Process>[^\"]+)"
| eval finish_time_epoch = strftime(strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S")
| eval start_time_epoch = strftime(strptime(START_TIME, "%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S")
| eval duration_s = strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S") - strptime(START_TIME, "%Y-%m-%d %H:%M:%S")
| eval duration_min = round(duration_s / 60, 2)
| chart sum(duration_min) as "time" by G_DT
Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| chart sum(duration_min) as "time" by G_DT Process

View solution in original post

dglauche
Engager

Hi,

not sure whats the content of your G_DT field but in general you can create a stacked chart like this:

| makeresults count=100 
| streamstats count as pid 
| eval _time=_time-(pid*3600), duration=random()%300
| timechart span=1d useother=f sum(duration) by pid

dglauche_0-1659604674173.png

 

ITWhisperer
SplunkTrust
SplunkTrust
| chart sum(duration_min) as "time" by G_DT Process
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...