Splunk Search

How to create trellis timechart with stacked bars

tdoSplunk
Path Finder

Hi,

I want to create a timechart as trellis with stacked bars.

I have the following columns:
Workdate, Duration, BookingType, LoginName

2019-06-03,5,1,User1
2019-06-03,2,2,User1
2019-06-03,1,3,User1
2019-06-03,3,1,User2
2019-06-03,3,2,User2
2019-06-03,2,3,User2
...

My Expectation is to see 2 Charts, one for User1 and one for User2 with a stacked bar for the Workdate 2019-06-01
The Total sum for each is 8, separated by the durations by BookingTypealt text

My first approach was to use |timechart sum(Duration) as Total by BookingType, then I get nearly the result I want. But it is not possible to use Trellis (by LoginName).

Do you have ideas on how to solve it?

best regards
Thomas

khristian_p
Engager

chart sum(Duration) by BookingType, LoginName

I wouldn't use Trellis because of how you want your chart stacked.

0 Karma

tdoSplunk
Path Finder

thank you for your respond, but it is a requirement to use trellis (to have a chart like this, splitted by LoginName). I think timechart is a good way, but perhaps I have to do some extra work before or after it

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...