Splunk Search

How to create a chart showing ticket status by week?

kvmanjunath
New Member

Hi all, I am trying to create a dashboard or a graph where I want to show the ticket status by weekly. I am uploading a csv file in which I have 3 fields
1) Weeks --> Values are week1, week2, week3 and week4
2) Status --> Closed and Pending
3) Team_names --> Team1, Team2 and Team3

I want to create a bar graph which shows weekly wise along with pending and closed in a single bar for each team.

I tried the below query but it is not showing in a single bar

| inputlookup July_2014.csv | stats count by status, WEEKs, team_name

Tags (3)
0 Karma

strive
Influencer

What you need is stacked bar chart. Use this option

<option name="charting.chart.stackMode">stacked</option>

XML File

<dashboard>
  <label>Stacked Bar Chart</label>
  <row>
    <chart>
      <searchString>|inputlookup test3.csv | chart count by Weeks Status</searchString>
      <title>BarChartTest</title>
      <earliestTime>-3d@d</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.chart">bar</option>
      <option name="charting.chart.stackMode">stacked</option>
    </chart>
  </row>
</dashboard>

Sample Data:

Weeks,Status,Teams
w1,Closed,Team1
w1,Pending,Team2
w1,Closed,Team3
w2,Closed,Team1
w2,Pending,Team2
w2,Closed,Team3
w3,Closed,Team2
w3,Pending,Team1
w3,Closed,Team3

Sample Chart:
alt text

0 Karma

somesoni2
Revered Legend

Teams have not been considered here. They need weekly stacked chart for status for each team. My guess is that chart overlay will be required (will have 6 series team (3) vs status (2))

0 Karma

strive
Influencer

You said you need your values in single bar. That is the property of stacked charts. For that you need to set stackMode option.

I have also given search that you should use.

0 Karma

kvmanjunath
New Member

Sorry, I did not understand...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...