Splunk Search

How to create a chart showing ticket status by week?

kvmanjunath
New Member

Hi all, I am trying to create a dashboard or a graph where I want to show the ticket status by weekly. I am uploading a csv file in which I have 3 fields
1) Weeks --> Values are week1, week2, week3 and week4
2) Status --> Closed and Pending
3) Team_names --> Team1, Team2 and Team3

I want to create a bar graph which shows weekly wise along with pending and closed in a single bar for each team.

I tried the below query but it is not showing in a single bar

| inputlookup July_2014.csv | stats count by status, WEEKs, team_name

Tags (3)
0 Karma

strive
Influencer

What you need is stacked bar chart. Use this option

<option name="charting.chart.stackMode">stacked</option>

XML File

<dashboard>
  <label>Stacked Bar Chart</label>
  <row>
    <chart>
      <searchString>|inputlookup test3.csv | chart count by Weeks Status</searchString>
      <title>BarChartTest</title>
      <earliestTime>-3d@d</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.chart">bar</option>
      <option name="charting.chart.stackMode">stacked</option>
    </chart>
  </row>
</dashboard>

Sample Data:

Weeks,Status,Teams
w1,Closed,Team1
w1,Pending,Team2
w1,Closed,Team3
w2,Closed,Team1
w2,Pending,Team2
w2,Closed,Team3
w3,Closed,Team2
w3,Pending,Team1
w3,Closed,Team3

Sample Chart:
alt text

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Teams have not been considered here. They need weekly stacked chart for status for each team. My guess is that chart overlay will be required (will have 6 series team (3) vs status (2))

0 Karma

strive
Influencer

You said you need your values in single bar. That is the property of stacked charts. For that you need to set stackMode option.

I have also given search that you should use.

0 Karma

kvmanjunath
New Member

Sorry, I did not understand...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...