Splunk Search

STACKED area chart??

a277437
Explorer

Will Splunk do a stacked area chart?  I'm able to get an area chart, but it's not 'stacked' (so each proxy totals to an aggregate).  I'm wondering if splunk can even do that?  I looked at the documentation and it appeared that it could, so I'm hoping maybe I'm just doing something wrong.  Under the 'Visualization"

index = "myindex"| bin _time span=5m
| stats sum(cs_bytes) as Bytes by proxy_server _time
| eval Kbps=(((Bytes*8)/1000)/300)
| timechart span=5m list(Kbps) by proxy_server

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Change the format of the area chart to stacked

ITWhisperer_0-1628055268921.png

 

View solution in original post

a277437
Explorer

Continuing from above...  "Under the Visualization" I selected the area chart. 

Thank you!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Change the format of the area chart to stacked

ITWhisperer_0-1628055268921.png

 

a277437
Explorer

That's it!!!  Thank you!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...