topic Constants in Splunk Bar Graph Charts in Dashboards & Visualizations

Constants in Splunk Bar Graph Charts

asarolkar — Wed, 12 Sep 2012 19:54:13 GMT

I have a query like this - which charts the number of grapes and pears in a fruit cart

sourcetype="fruitlog" type="pear" OR type="grape" | eval InStock=10 | chart first(InStock) as InStock,count(eval(type="pear")) AS numPears, count(eval(type="grape")) AS numGrapes

The InStock amount is the total number of fruits that is UNRELATED to the number of Pears and Grapes.

When I put this up on a dashboard, NO bar appears for the InStock Value of 10. I see numPears and I see numGrapes.

Any ideas so as to why this CONSTANT value would not display on a chart ? It might sound stupid to even have it there, but I need for it to show for comparison.

Re: Constants in Splunk Bar Graph Charts

Ayn — Wed, 12 Sep 2012 20:18:51 GMT

It's not that it's a constant, it's that your search will generate one row with multiple columns and the first column will be the one used by the bar chart for the Y-axis label. Try removing the first part of your chart command and you'll see that numPears will disappear from the bar chart and instead be used as a label.

Re: Constants in Splunk Bar Graph Charts

asarolkar — Wed, 12 Sep 2012 20:27:03 GMT

So, how would you recommend I frame my search.

A timechart is not desired here but just a chart.

Re: Constants in Splunk Bar Graph Charts

jonuwz — Wed, 12 Sep 2012 21:51:18 GMT

Add this to the end of your search

 | transpose | rename "row 1" as count

The trick is to get your data in multiple rows, not across multiple columns.

You can also replace 'chart' with 'stats'

A neater search might be

sourcetype="fruitlog" type="pear" OR type="grape"
| stats count by type 
| appendpipe [ head 1 | eval type="InStock" | eval count=10 | fields type count ]

The 1st 2 lines gets the count per type (which will graph as-is)

the last line just spoofs an entry for InStock

Re: Constants in Splunk Bar Graph Charts

asarolkar — Wed, 12 Sep 2012 22:02:11 GMT

sourcetype="fruitlog" type="pear" OR type="grape" | eval InStock=10 | chart first(InStock) as InStock,count(eval(type="pear")) AS numPears, count(eval(type="grape")) AS numGrapes | transpose | rename "row 1" as count ???

Re: Constants in Splunk Bar Graph Charts

jonuwz — Wed, 12 Sep 2012 22:09:27 GMT

yeah - i don't have your data, but this seems to be similar to what you're using :

index=_internal | eval instock=10 | stats first(instock) as instock count(eval(group=="pipeline")) as pipe count(eval(group=="queue")) as queue | transpose | rename "row 1" as count`