Splunk Search

How to create a chart showing ticket status by week?

kvmanjunath
New Member

Hi all, I am trying to create a dashboard or a graph where I want to show the ticket status by weekly. I am uploading a csv file in which I have 3 fields
1) Weeks --> Values are week1, week2, week3 and week4
2) Status --> Closed and Pending
3) Team_names --> Team1, Team2 and Team3

I want to create a bar graph which shows weekly wise along with pending and closed in a single bar for each team.

I tried the below query but it is not showing in a single bar

| inputlookup July_2014.csv | stats count by status, WEEKs, team_name

Tags (3)
0 Karma

strive
Influencer

What you need is stacked bar chart. Use this option

<option name="charting.chart.stackMode">stacked</option>

XML File

<dashboard>
  <label>Stacked Bar Chart</label>
  <row>
    <chart>
      <searchString>|inputlookup test3.csv | chart count by Weeks Status</searchString>
      <title>BarChartTest</title>
      <earliestTime>-3d@d</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.chart">bar</option>
      <option name="charting.chart.stackMode">stacked</option>
    </chart>
  </row>
</dashboard>

Sample Data:

Weeks,Status,Teams
w1,Closed,Team1
w1,Pending,Team2
w1,Closed,Team3
w2,Closed,Team1
w2,Pending,Team2
w2,Closed,Team3
w3,Closed,Team2
w3,Pending,Team1
w3,Closed,Team3

Sample Chart:
alt text

0 Karma

somesoni2
Revered Legend

Teams have not been considered here. They need weekly stacked chart for status for each team. My guess is that chart overlay will be required (will have 6 series team (3) vs status (2))

0 Karma

strive
Influencer

You said you need your values in single bar. That is the property of stacked charts. For that you need to set stackMode option.

I have also given search that you should use.

0 Karma

kvmanjunath
New Member

Sorry, I did not understand...

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...