I have a basic query that generates the following results from splunk(6)'s' main query page (not a panel or anything):
100 4
What is the trick to get this displayed as a stacked 100% column chart? I have played with every configuration including stack mode: 100% stacked, multi series mode, split/combined, etc, et,c. All I get is on big column fill, nothing stacked. What am I missing here?
This works for me :
| stats count as success | eval success = 100 | eval failure = 125 | eval dummy = 1 | table dummy success failure
This works for me :
| stats count as success | eval success = 100 | eval failure = 125 | eval dummy = 1 | table dummy success failure
great thanks! that works. stacked success/failure. I was missing the entire query structure. however, what is the reason behind the dummy eval? if I take the dummy out of the query it fails to stack. Is that a requirement to add another dummy node in there in order to get something to render?