Splunk Search

What is the trick to stack column charts in splunk 6?

jaj
Path Finder

I have a basic query that generates the following results from splunk(6)'s' main query page (not a panel or anything):

success fail

100 4

What is the trick to get this displayed as a stacked 100% column chart? I have played with every configuration including stack mode: 100% stacked, multi series mode, split/combined, etc, et,c. All I get is on big column fill, nothing stacked. What am I missing here?

0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

This works for me :

| stats count as success | eval success = 100 | eval failure = 125 | eval dummy = 1 | table dummy success failure

View solution in original post

dart
Splunk Employee
Splunk Employee

This works for me :

| stats count as success | eval success = 100 | eval failure = 125 | eval dummy = 1 | table dummy success failure

jaj
Path Finder

great thanks! that works. stacked success/failure. I was missing the entire query structure. however, what is the reason behind the dummy eval? if I take the dummy out of the query it fails to stack. Is that a requirement to add another dummy node in there in order to get something to render?

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...