Splunk Search

What is the trick to stack column charts in splunk 6?

jaj
Path Finder

I have a basic query that generates the following results from splunk(6)'s' main query page (not a panel or anything):

success fail

100 4

What is the trick to get this displayed as a stacked 100% column chart? I have played with every configuration including stack mode: 100% stacked, multi series mode, split/combined, etc, et,c. All I get is on big column fill, nothing stacked. What am I missing here?

0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

This works for me :

| stats count as success | eval success = 100 | eval failure = 125 | eval dummy = 1 | table dummy success failure

View solution in original post

dart
Splunk Employee
Splunk Employee

This works for me :

| stats count as success | eval success = 100 | eval failure = 125 | eval dummy = 1 | table dummy success failure

jaj
Path Finder

great thanks! that works. stacked success/failure. I was missing the entire query structure. however, what is the reason behind the dummy eval? if I take the dummy out of the query it fails to stack. Is that a requirement to add another dummy node in there in order to get something to render?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...