How can I create a stacked line graph with multiple values from the same log line?

[Glenn]

I am having trouble getting my head around the search required to graph multiple values from the same log event. It seems to be easy enough to graph one value - "timechart sum(field4)" or one value against another - "timechart sum(field4) by field2", but any more I can't work out.

I have a csv report that contains a bunch of statistics. I have built a search which extracts into named fields. I want to create a (timechart) stacked line graph that takes field4 ("ordertype1", 138 in the first line below), field5 ("ordertype2", 86) and field6 ("ordertype3", 0) and plots them over time with ordertype1/2/3 in the legend. The goal is to have a stacked line graph that stacks up to a total orders value, showing the different types of orders that made up this total.

I hope I havent made that question too confusing. Please ask if you would like me to explain it again.

Sample log:

15-MAR-2010 09:09,WEB,OS,138,86,0,224,47,29,168,23,14,83,24,14,140,15-MAR-10,15-MAR-10,15-MAR-10
15-MAR-2010 09:10,WEB,OS,132,78,0,210,53,29,590,28,14,574,25,14,151,15-MAR-10,15-MAR-10,15-MAR-10
15-MAR-2010 09:11,WEB,OS,132,55,0,187,48,30,288,24,15,148,48,14,4597,15-MAR-10,15-MAR-10,15-MAR-10

[ziegfried · Accepted solution]

The timechart commands allows to perform multiple accummulations like this:

<your search> | timechart sum(field4) as ordertype1 sum(field5) as ordertype2 sum(field6) as ordertype3

Putting the results into an stacked area chart should produce a quite reasonable chart.

[gkanapathy]

Note that you can currently (4.0) not use multiple fields with a by group:

... | timechart count(x), count(y) as cy, sum(z) by A

(this will give you an error) but you can get the desired results with a slightly more complex search: http://www.splunk.com/base/Documentation/4.0.10/User/ReportOfMultipleDataSeries

[Johnvey · Accepted solution]

You can chain together multiple series definition in timechart:

search foo bar | timechart sum(field4) sum(field5) sum(field6)

If you want to rename your series inline:

search foo bar | timechart sum(field4) as ordertype1 sum(field5) as ordertype2 sum(field6) as ordertype3

Assuming you're in the report builder view, there is a drop down box labeled "stack mode" that will let you choose between the various stacking options.

The reason that your original search didn't work is because the by clause in the timechart command is a multiplexer: it takes a single field and generates multiple series by splitting it out by its values. Because your series data is already in separate fields, there is no need for the splitting -- just multiple field references.

[Glenn]

Works a treat thanks.

[ziegfried · Accepted solution]

The timechart commands allows to perform multiple accummulations like this:

<your search> | timechart sum(field4) as ordertype1 sum(field5) as ordertype2 sum(field6) as ordertype3

Putting the results into an stacked area chart should produce a quite reasonable chart.

[Glenn]

Thanks for the correct answer, but Johnvey got there first! It's a pity I can't mark two answers as correct.