Hi All, I’m trying to create a stacked Vertical bar chart in Splunk, where each bar represents a unique field (e.g., SWC), and the bar is segmented into multiple colors based on a specific status field (e.g., RAG_Status with values Green, Amber, and Red). Here’s what I’m trying to achieve: • Each horizontal bar corresponds to a unique SWC. • The bar is segmented based on the RAG_Status (e.g., Green, Amber, Red). • The length of each segment represents the count of records for that combination. • I want the segments to be stacked within the bar, with distinct colors for Green, Amber, and Red. Sample Query:   | inputlookup example_data.csv | eval RAG_Status = case( KPI_Score >= KPI_Threshold, "Green", KPI_Score >= (KPI_Threshold - 5), "Amber", KPI_Score < (KPI_Threshold - 5), "Red" ) | chart count BY SWC RAG_Status | sort SWC   Visualization Requirements: 1. Chart Type: Vertical Bar Chart. 2. Stacked Mode: Each bar should show Green, Amber, and Red segments stacked horizontally. 3. Color Scheme: • Green: #28a745 • Amber: #ffc107 • Red: #dc3545. Screenshot for Reference: The above is an example of horizontal but I am looking for vertical.  Current Issue: I’m unable to configure the Splunk visualization settings or XML code to properly display this data as a Vertical stacked bar chart. Either the entire bar shows as one solid color, or the segments are not stacking as expected. Any guidance or sample XML code to achieve this would be greatly appreciated! Current XML code:-    <dashboard version="1.1" theme="light"> <label>SWC KPI Performance and RAG Distribution_new</label> <row> <panel> <title>RAG Status Distribution by SWC</title> <chart> <search> <query>| inputlookup example_data.csv | eval RAG_Status = case( KPI_Score >= KPI_Threshold, "Green", KPI_Score >= (KPI_Threshold - 5), "Amber", KPI_Score < (KPI_Threshold - 5), "Red" ) | chart count BY SWC RAG_Status | sort SWC</query> <earliest>@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.chart">column</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.seriesColors">#28a745,#ffc107,#dc3545</option> <option name="charting.legend.placement">right</option> <option name="charting.axisTitleX.text">SWC</option> <option name="charting.axisTitleY.text">count</option> </chart> </panel> </row> </dashboard>   Current situation:-  Thanks in advance! ... View more

How do I merge the below 2 complex queries? Let me know if it's possible in Splunk? Search 1: -      index=ABC (eventtype=X OR eventtype=Y) log_subtype=DEF field_A="*SQL*" | stats values(A) as A values(B) as B values(C) as C BY X, Y | where B > 2 | search NOT [|inputlookup test_1.csv | fields X ] | search NOT [|inputlookup test_2.csv | fields X ] | eval name="search_1"       Search 2: -     index=ABC (log_subtype="GHI" OR log_subtype="JKL") (severity="medium" OR severity="high" OR severity="critical") action=* NOT (field_B="Unknown(5000007)" AND action="blocked") NOT dest_ip="11.22.33.44" | stats values(D) as D values(E) as E values(A) as A BY X, Y | eval name="search_2"       I succeeded on merging the 2 searches up to some extent (up to stats command)     index=ABC (log_subtype="DEF" OR log_subtype="GHI" OR log_subtype="JKL")(((eventtype=X OR eventtype=Y) field_A="*SQL*") OR ((severity="medium" OR severity="high" OR severity="critical") action=* NOT (field_B="Unknown(5000007)" AND action="blocked") NOT dest_ip="11.22.33.44" )) | stats values(A) as A values(B) as B values(C) as C values(D) as D BY X, Y       I am not sure on how I can apply where condition and exclusion lookups from search 1 while combining as they are specific to search 1 and do not want to apply those to search 2?             ... View more