I have four fields, baseline, lvl1,lvl2,lv3. I have to compare baseline vs (lvl1+lvl2+lvl3) to see if sum of lvl1,lvl2,lvl3 is exceeding the baseline.
For that purpose I created stacked chart but it is combining all four fields including baseline, in bar.
Expected result:
Here blue is baseline and others are lvl1, lvl2,lvl3 in stack mode.
Any help would be great!!
@prafulljha, with the current Column Chart in Splunk, you can either have Stacked or non stacked chart but not a combination of both. So as @cusello has stated, you can use Baseline as overlay field and for coloring the series you would need to use charting.fieldColors Simple XML Chart Configuration (https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr...
<option name="charting.fieldColors">{"lvl1":0x00FF00,"lvl2":0xFFC200,"lvl3":0xFF0000}</option>
As evident, the above expects your series names to be lvl1, lvl2 and lvl3 and also if Baseline is the first series it will be picked up as Blue by default series color for the first series.
If you need the Columns as per your screenshot, you might have to build your own custom visualization using Highcharts JS library. Refer to documentation for Building Custom Visualization: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial
@niketnilay, thanks for your idea, actually this i have already done, the problem we are facing is difficulties while hovering and while clicking on the bar for lvls to see the data below (as these columns are populating data below in tabular form) as this baseline overlay always comes in between(if the values are of same range).
Here is how my panel looks like.
Can you please suggest any alternative way to achieve the same in splunk?
Thanks.
@prafulljha, with the current Column Chart in Splunk, you can either have Stacked or non stacked chart but not a combination of both. So as @cusello has stated, you can use Baseline as overlay field and for coloring the series you would need to use charting.fieldColors Simple XML Chart Configuration (https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr...
<option name="charting.fieldColors">{"lvl1":0x00FF00,"lvl2":0xFFC200,"lvl3":0xFF0000}</option>
As evident, the above expects your series names to be lvl1, lvl2 and lvl3 and also if Baseline is the first series it will be picked up as Blue by default series color for the first series.
If you need the Columns as per your screenshot, you might have to build your own custom visualization using Highcharts JS library. Refer to documentation for Building Custom Visualization: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomVizTutorial
You have two options,
1) You can use Left Click and Drag option to zoom in to smaller/specific range so that selection of various series is easier.
2) Splunk Enterprise 7.0 came up with new seriesCompare as legend mode using Simple XML Chart configuration: <option name="charting.legend.mode">seriesCompare</option>. This will allow you to hover over a specific region on chart and it will show selected values for all series for that region. This would however work only on Line Chart not Column Chart.
