Dashboards & Visualizations

How to create a stacked bar graph with 2 y axis attributes?

nyasharashad59
Explorer

Good day

I have two attributes for my graph which are over time. subscriber_ap (which should read the value on y axis) and subscriber_fup which is color.

I have managed to create the graph with subscriber_fup (color) but my subscriber_ap which is supposed to be a stacked graph it is not showing. if you find attached screenshot, when subscriber_ap = 0 it should count 4 bars on the y axis, if subscriber_fup is 200 it should be read, which means at a particular time we should have 4 red bars, if subscriber_ap=100 =3 bars on Y axis, when subscriber_fup is zero it should paint green hence have 3 green bars at that particular timealt text

  <chart>
    <search>
      <query>index=sandvine sourcetype=sql subscriber_name="$subscriberid$"
      | eval 4 = if(subscriber_ap=200,subscriber_ap,0)
      | eval 3 = if(subscriber_ap=150,subscriber_ap,0)
      | eval 2 = if(subscriber_ap=100,subscriber_ap,0)
      | eval 1 = if(subscriber_ap=0,subscriber_ap,0)
      | eval green = if( subscriber_fup=0,subscriber_fup,0)
      | eval yellow = if(subscriber_fup=100,subscriber_fup,0)
      | eval orange = if(subscriber_fup=150,subscriber_fup,0)
      | eval red = if(subscriber_fup=200,subscriber_fup,0)
      | timechart span=30m values(green) as "Green" values(yellow) as "Yellow" values(orange) as "Orange" values(red) as "Red"
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

try this

 index=sandvine sourcetype=sql subscriber_name="$subscriberid$"
 | bin _time span=1h
 | stats max(subscriber_ap) as SAP max(subscriber_fup) as FUP 
 | eval chartbars=round(SAP/50)
 | eval chartcolor=case(FUP>=150,"orange", FUP>=100,"yellow", true(),"green")
 | timechart span=1h max(chartbars) by chartcolor

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

try this

 index=sandvine sourcetype=sql subscriber_name="$subscriberid$"
 | bin _time span=1h
 | stats max(subscriber_ap) as SAP max(subscriber_fup) as FUP 
 | eval chartbars=round(SAP/50)
 | eval chartcolor=case(FUP>=150,"orange", FUP>=100,"yellow", true(),"green")
 | timechart span=1h max(chartbars) by chartcolor
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...