Splunk Search

Struggling with stacked bar chart to show time spent in different places

PanKokos
Path Finder

Hi,

We are trying to use Splunk to provide some nice diagrams showing execution time of critical sections in reference to total execution time.

Let's say this is our input:

   Type ="Perf"  Section="TOTAL" FlowType="F1" RequestType="R1" Time="23"
    Type="Perf" Section="A" FlowType="F1" RequestType="R1" Time="3"
    Type="Perf" Section="B" FlowType="F1" RequestType="R1" Time="13"
    Type="Perf" Section="TOTAL" FlowType="F2" RequestType="R2" Time="45"
    Type="Perf" Section="A" FlowType="F2" RequestType="R2" Time="30"
    Type="Perf" Section="B" FlowType="F2" RequestType="R2" Time="3"

What we would like to have is a stacked bar chart, which will be high as value in Total and inside will have a bar for each Section and the difference will shown as OTHER (in case of first 3 rows OTHER = 7)

So the y axis is time and the x axis is FlowType + RequestType. I am trying different queries but could not get anything yet... any ideas?

This is hwat I got so far:

source | where Type="Perf" | 
stats avg(Time) as AvgTime sum(Time) as Time values(Section) as SectionName by Section FlowType RequestType |
eval Reference = "(".FlowType."-".SectionType.")" |
eventstats avg(Time) as "AvgSectionTime" by FlowType RequestType SectionName |
chart values(AvgSectionTime) as Time over Reference by SectionName

This is not resolving all the issues, but it generates the stacked bar chart.

Best regards,
Michal

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

 source | where Type="Perf" | eval Reference = "(".FlowType."-".SectionType.")" | chart sum(Time) as Time over Reference by SectionName | addtotals fieldname=OTHER | eval OTHER=2*Total - OTHER | fields - Total | table Reference * OTHER

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

 source | where Type="Perf" | eval Reference = "(".FlowType."-".SectionType.")" | chart sum(Time) as Time over Reference by SectionName | addtotals fieldname=OTHER | eval OTHER=2*Total - OTHER | fields - Total | table Reference * OTHER
0 Karma

PanKokos
Path Finder

Hi,

Clever!

Also I didn't know that I can directly call fields in eval (e.g. ... | eval SUM = A + B). How I have missed that? This simplified the things a lot!

Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...