Splunk Search

How to create trellis timechart with stacked bars

tdoSplunk
Path Finder

Hi,

I want to create a timechart as trellis with stacked bars.

I have the following columns:
Workdate, Duration, BookingType, LoginName

2019-06-03,5,1,User1
2019-06-03,2,2,User1
2019-06-03,1,3,User1
2019-06-03,3,1,User2
2019-06-03,3,2,User2
2019-06-03,2,3,User2
...

My Expectation is to see 2 Charts, one for User1 and one for User2 with a stacked bar for the Workdate 2019-06-01
The Total sum for each is 8, separated by the durations by BookingTypealt text

My first approach was to use |timechart sum(Duration) as Total by BookingType, then I get nearly the result I want. But it is not possible to use Trellis (by LoginName).

Do you have ideas on how to solve it?

best regards
Thomas

khristian_p
Engager

chart sum(Duration) by BookingType, LoginName

I wouldn't use Trellis because of how you want your chart stacked.

0 Karma

tdoSplunk
Path Finder

thank you for your respond, but it is a requirement to use trellis (to have a chart like this, splitted by LoginName). I think timechart is a good way, but perhaps I have to do some extra work before or after it

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...