Splunk Search

How do I create a stacked bar graph with 2 fields?

jhoang
Path Finder

Hi,

I am trying to create a stacked bar graph, using 2 fields.

First field is Level, second field is Urgency. I want to sort the columns based on Level, and displaying the number of different Urgency in the stacked column. See below, the long column would show 2 critical items, 1 high, and 1 medium items, for a total of 4 items.

Level Urgency
Long Critical
Long Critical
Long High
Long Medium
Medium High
Medium Low
Medium Low
Medium Low

1 Solution

somesoni2
Revered Legend

Try something like this

your search giving above output (two fields) | chart count over Level by Urgency

Select the appropriate option in the visualization to create stacked chart.

View solution in original post

somesoni2
Revered Legend

Try something like this

your search giving above output (two fields) | chart count over Level by Urgency

Select the appropriate option in the visualization to create stacked chart.

jhoang
Path Finder

Thank you brother!!!!

0 Karma

arbelron3
New Member

hey,
I tried and I dont get a graph for each Urgency but a seperated values... it erases some of the points... does someone know why and how I correct it ?

0 Karma

jhoang
Path Finder

Note - this is for year to date data. Is it possible to display this without using the timechart option ?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...