After a bit of working through this and understanding it, this works perfectly, TY   The below is closer to the actual data I was using.   | makeresults format=csv data="bus_date, appl, tran_count 20250122,appl1,336474 20250122,appl2,93 20250122,appl3,6 20250122,appl4,10585 20250123,appl1,2061 20250123,appl2,1075 20250123,appl3,1 20250123,appl4,190 20250124,appl1,6 20250124,appl2,40635 20250124,appl3,786 20250124,appl4,12978 20250125,appl1,140 20250125,appl2,133 20250125,appl3,514 20250125,appl4,125449 20250126,appl1,98 20250126,appl2,5 20250126,appl3,5258 20250126,appl4,3424 20250127,appl1,596 20250127,appl2,1 20250127,appl3,265 20250127,appl4,3 20250128,appl1,38200 20250128,appl2,1320 20250128,appl3,11706 20250128,appl4,114" | fields bus_date, appl, tran_count | streamstats c by appl | sort bus_date | stats latest(bus_date) as bus_date avg(eval(if(c=1, null(), tran_count))) as Avg6day latest(tran_count) as todays_total by appl | eval Variance=todays_total-Avg6day | sort appl - bus_date | table bus_date appl, todays_total, Avg6day, Variance ... View more

Thank you the below seems to work, however, for some reason the search only shows sys1 thru sys5.   It does not matter which how many rows I put in the data, it won't show more than 5.     | makeresults format=csv data="field1, field2, field3, field4, field4, field5, field6, field7, field8, field9 sys1,10,a,10,c,20,a,10,20 sys2,20,b,10,c,20,a,10,20 sys3,10,c,10,c,20,a,10,20 sys4,30,d,10,c,20,a,10,20 sys5,40,a,10,c,20,a,10,20 sys6,20,c,10,c,20,a,10,20 sys7,50,d,10,c,20,a,10,20 sys8,10,e,10,c,20,a,10,20" | table field1 field2 field3 field4 field5 field6 field7 field8 field9 | transpose header_field=field1| foreach * [eval _row_values = mvappend(_row_values, <<FIELD>>)] | where mvcount(mvdedup(_row_values)) != 1 ... View more

perfect, thank you ... View more

On one hand thank you very much, changing this to a column makes the stacked work.   On the other hand the documentation I was reading did list the stackmode under line charts, so that is a bit confusing. Chart configuration reference - Splunk Documentation The teams would prefer the line graphs as that is more common for us, but this does get the desired visual. Thank you ... View more

Thank you, I had to play around with my search a bit, but this overall syntax was the trick ... View more

I've tried the below with the fieldformat before and after the chart command, same results, the duration_U field still shows as a unix date, to the chart is technically correct, but the y axis information is not human readable.   Just shows values ranging from 70,000 to 90,000. index= source= | strcat date "000000" BDATE | eval duration_U=strptime(end_time,"%Y-%m-%d %H:%M:%S.%N") - strptime(BDATE,"%Y%m%d%H%M%S") |fieldformat duration_U=tostring(duration_U,"duration")| chart latest(duration_U) over system by date   ... View more