Will this work? (based on Splunk's sample data model internal_server)
<dashboard>
<label>StackedPivot</label>
<row>
<chart>
<searchString>| pivot internal_server server count(sourcetype) AS "Count" SPLITROW _time AS "_time" PERIOD minute SPLITCOL sourcetype SORT 0 _time NUMCOLS 100</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.legend.placement">right</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
</chart>
</row>
</dashboard>
Will this work? (based on Splunk's sample data model internal_server)
<dashboard>
<label>StackedPivot</label>
<row>
<chart>
<searchString>| pivot internal_server server count(sourcetype) AS "Count" SPLITROW _time AS "_time" PERIOD minute SPLITCOL sourcetype SORT 0 _time NUMCOLS 100</searchString>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.legend.placement">right</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.chart">bar</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
</chart>
</row>
</dashboard>
So the trick is to splitrow by _time and splitcol by what you want stacked. Thanks for shraring!
End users can use the pivot search in Search app and selecting required visualization options. Same can be done from the Pivot (create/update) view. (this code is the saved pivot report from Pivot view)
It will in a dashboard view, I am trying to figure out if I can let end users do it in the Pivot panel...