Splunk Search

STACKED area chart??

a277437
Explorer

Will Splunk do a stacked area chart?  I'm able to get an area chart, but it's not 'stacked' (so each proxy totals to an aggregate).  I'm wondering if splunk can even do that?  I looked at the documentation and it appeared that it could, so I'm hoping maybe I'm just doing something wrong.  Under the 'Visualization"

index = "myindex"| bin _time span=5m
| stats sum(cs_bytes) as Bytes by proxy_server _time
| eval Kbps=(((Bytes*8)/1000)/300)
| timechart span=5m list(Kbps) by proxy_server

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Change the format of the area chart to stacked

ITWhisperer_0-1628055268921.png

 

View solution in original post

a277437
Explorer

Continuing from above...  "Under the Visualization" I selected the area chart. 

Thank you!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Change the format of the area chart to stacked

ITWhisperer_0-1628055268921.png

 

a277437
Explorer

That's it!!!  Thank you!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...