Struggling with stacked bar chart to show time spent in different places

[PanKokos]

Hi,

We are trying to use Splunk to provide some nice diagrams showing execution time of critical sections in reference to total execution time.

Let's say this is our input:

   Type ="Perf"  Section="TOTAL" FlowType="F1" RequestType="R1" Time="23"
    Type="Perf" Section="A" FlowType="F1" RequestType="R1" Time="3"
    Type="Perf" Section="B" FlowType="F1" RequestType="R1" Time="13"
    Type="Perf" Section="TOTAL" FlowType="F2" RequestType="R2" Time="45"
    Type="Perf" Section="A" FlowType="F2" RequestType="R2" Time="30"
    Type="Perf" Section="B" FlowType="F2" RequestType="R2" Time="3"

What we would like to have is a stacked bar chart, which will be high as value in Total and inside will have a bar for each Section and the difference will shown as OTHER (in case of first 3 rows OTHER = 7)

So the y axis is time and the x axis is FlowType + RequestType. I am trying different queries but could not get anything yet... any ideas?

This is hwat I got so far:

source | where Type="Perf" | 
stats avg(Time) as AvgTime sum(Time) as Time values(Section) as SectionName by Section FlowType RequestType |
eval Reference = "(".FlowType."-".SectionType.")" |
eventstats avg(Time) as "AvgSectionTime" by FlowType RequestType SectionName |
chart values(AvgSectionTime) as Time over Reference by SectionName

This is not resolving all the issues, but it generates the stacked bar chart.

Best regards,
Michal

[somesoni2 · Accepted solution]

Try something like this

 source | where Type="Perf" | eval Reference = "(".FlowType."-".SectionType.")" | chart sum(Time) as Time over Reference by SectionName | addtotals fieldname=OTHER | eval OTHER=2*Total - OTHER | fields - Total | table Reference * OTHER

[PanKokos]

Hi,

Clever!

Also I didn't know that I can directly call fields in eval (e.g. ... | eval SUM = A + B). How I have missed that? This simplified the things a lot!

Thanks!