Splunk Search

What is the trick to stack column charts in splunk 6?

jaj
Path Finder

I have a basic query that generates the following results from splunk(6)'s' main query page (not a panel or anything):

success fail

100 4

What is the trick to get this displayed as a stacked 100% column chart? I have played with every configuration including stack mode: 100% stacked, multi series mode, split/combined, etc, et,c. All I get is on big column fill, nothing stacked. What am I missing here?

0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

This works for me :

| stats count as success | eval success = 100 | eval failure = 125 | eval dummy = 1 | table dummy success failure

View solution in original post

dart
Splunk Employee
Splunk Employee

This works for me :

| stats count as success | eval success = 100 | eval failure = 125 | eval dummy = 1 | table dummy success failure

jaj
Path Finder

great thanks! that works. stacked success/failure. I was missing the entire query structure. however, what is the reason behind the dummy eval? if I take the dummy out of the query it fails to stack. Is that a requirement to add another dummy node in there in order to get something to render?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...