Splunk Search

Struggling with stacked bar chart to show time spent in different places

PanKokos
Path Finder

Hi,

We are trying to use Splunk to provide some nice diagrams showing execution time of critical sections in reference to total execution time.

Let's say this is our input:

   Type ="Perf"  Section="TOTAL" FlowType="F1" RequestType="R1" Time="23"
    Type="Perf" Section="A" FlowType="F1" RequestType="R1" Time="3"
    Type="Perf" Section="B" FlowType="F1" RequestType="R1" Time="13"
    Type="Perf" Section="TOTAL" FlowType="F2" RequestType="R2" Time="45"
    Type="Perf" Section="A" FlowType="F2" RequestType="R2" Time="30"
    Type="Perf" Section="B" FlowType="F2" RequestType="R2" Time="3"

What we would like to have is a stacked bar chart, which will be high as value in Total and inside will have a bar for each Section and the difference will shown as OTHER (in case of first 3 rows OTHER = 7)

So the y axis is time and the x axis is FlowType + RequestType. I am trying different queries but could not get anything yet... any ideas?

This is hwat I got so far:

source | where Type="Perf" | 
stats avg(Time) as AvgTime sum(Time) as Time values(Section) as SectionName by Section FlowType RequestType |
eval Reference = "(".FlowType."-".SectionType.")" |
eventstats avg(Time) as "AvgSectionTime" by FlowType RequestType SectionName |
chart values(AvgSectionTime) as Time over Reference by SectionName

This is not resolving all the issues, but it generates the stacked bar chart.

Best regards,
Michal

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

 source | where Type="Perf" | eval Reference = "(".FlowType."-".SectionType.")" | chart sum(Time) as Time over Reference by SectionName | addtotals fieldname=OTHER | eval OTHER=2*Total - OTHER | fields - Total | table Reference * OTHER

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

 source | where Type="Perf" | eval Reference = "(".FlowType."-".SectionType.")" | chart sum(Time) as Time over Reference by SectionName | addtotals fieldname=OTHER | eval OTHER=2*Total - OTHER | fields - Total | table Reference * OTHER
0 Karma

PanKokos
Path Finder

Hi,

Clever!

Also I didn't know that I can directly call fields in eval (e.g. ... | eval SUM = A + B). How I have missed that? This simplified the things a lot!

Thanks!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...