Splunk Search

How can I make a stacked Column chart?

Edwin1471
Path Finder

Hi, 

how can I make a stacked column chart . Currently the Purple area displays how long it took for all processes combined to execute. How could I modify my spl query so that it would display how long each individual process took to complete in a column chart.    (A1, A2, A3 - process names)

Edwin1471_0-1659601687145.pngEdwin1471_1-1659601918657.png

 

| rex field=PROCESS_NAME ":(?<Process>[^\"]+)"
| eval finish_time_epoch = strftime(strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S")
| eval start_time_epoch = strftime(strptime(START_TIME, "%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S")
| eval duration_s = strptime(FINISH_TIME, "%Y-%m-%d %H:%M:%S") - strptime(START_TIME, "%Y-%m-%d %H:%M:%S")
| eval duration_min = round(duration_s / 60, 2)
| chart sum(duration_min) as "time" by G_DT
Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| chart sum(duration_min) as "time" by G_DT Process

View solution in original post

dglauche
Engager

Hi,

not sure whats the content of your G_DT field but in general you can create a stacked chart like this:

| makeresults count=100 
| streamstats count as pid 
| eval _time=_time-(pid*3600), duration=random()%300
| timechart span=1d useother=f sum(duration) by pid

dglauche_0-1659604674173.png

 

ITWhisperer
SplunkTrust
SplunkTrust
| chart sum(duration_min) as "time" by G_DT Process
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...