Set up stacked distribution for views and reports

Set up the distribution component on a view or report so that you can see the distribution of events related to a specific field.

You can select the field to stack by when you add the component to a view or report. When you access the view, you can change the settings, set the time interval, and set the chart type and details.

Note: You can't use the Stacking and Compare features in the same query.


  1. Drag and drop the Distribution component on a view (see Add a custom view) or a report (see Add report layout), then select the type of query.
    Note: Stacking is not available for Collection Rate or Average (for example, Avg Severity Per Alert or Avg Duration Per Flow) distribution queries.
  2. On the second page of the Query Wizard, click Stacking, then select the options.
  3. Click OK on the Stacking Options page and Finish on the Query Wizard.


The view is added. You can change the settings, and set the time interval and chart type by clicking the Chart Options icon .