https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/creating-a-stacked-bar-chart-using-xql/m-p/1220568#M7891 <P>&nbsp;</P> <P>I am creating a stacked bar chart that shows the number of alerts per data source per day.<BR />Is it possible to display the data source in the displayed graph?<BR /><BR /></P> <P>The stacked bar I created shows the time.<BR />※<SPAN>Whatever I select for the X-axis will be displayed in a stacked graph.</SPAN></P> <P><SPAN><BR />A reference image is attached.&nbsp;<BR /></SPAN></P> <P><LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;</P> Sat, 15 Feb 2025 13:30:04 GMT Hisashi_Abe 2025-02-15T13:30:04Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/creating-a-stacked-bar-chart-using-xql/m-p/1220568#M7891 <P>&nbsp;</P> <P>I am creating a stacked bar chart that shows the number of alerts per data source per day.<BR />Is it possible to display the data source in the displayed graph?<BR /><BR /></P> <P>The stacked bar I created shows the time.<BR />※<SPAN>Whatever I select for the X-axis will be displayed in a stacked graph.</SPAN></P> <P><SPAN><BR />A reference image is attached.&nbsp;<BR /></SPAN></P> <P><LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;</P> Sat, 15 Feb 2025 13:30:04 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/creating-a-stacked-bar-chart-using-xql/m-p/1220568#M7891 Hisashi_Abe 2025-02-15T13:30:04Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/creating-a-stacked-bar-chart-using-xql/m-p/1220949#M7930 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/193463">@Hisashi_Abe</a>&nbsp;,</P> <P>&nbsp;</P> <P><SPAN>Thanks for reaching out on LiveCommunity!</SPAN></P> <P>&nbsp;</P> <P><SPAN>Can you please run below query and let me know if you are looking for the provided result.</SPAN></P> <P><SPAN>dataset = alerts | fields _time , alert_source , alert_name <BR />|bin _time span = 1d<BR />|comp count(alert_name ) as alert_count by alert_source , _time<BR />|sort desc _time<BR />| view graph type = column subtype = grouped xaxis = alert_source yaxis = alert_count </SPAN></P> <P>&nbsp;</P> <P><SPAN>If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.</SPAN></P> Wed, 19 Feb 2025 15:45:30 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/creating-a-stacked-bar-chart-using-xql/m-p/1220949#M7930 aspatil 2025-02-19T15:45:30Z