<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How do you create a line graph which shows 3 values? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430740#M40815</link>
    <description>&lt;P&gt;This is very close, need to do some tweeks. seems to be working.&lt;/P&gt;

&lt;P&gt;Thanks so much for the help! &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
    <pubDate>Fri, 19 Oct 2018 15:32:12 GMT</pubDate>
    <dc:creator>QuintonS</dc:creator>
    <dc:date>2018-10-19T15:32:12Z</dc:date>
    <item>
      <title>How do you create a line graph which shows 3 values?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430733#M40808</link>
      <description>&lt;P&gt;Rookie Question: I am trying to create a line graph showing 3 values. i have the query which works perfectly to show "ratings" per site for each site per week. But i want to show the overall rating for both sites as well.&lt;/P&gt;

&lt;P&gt;here is the query i use..&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%V")
| chart avg(overall_rating) over week by area
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;area= field name and contains values for 2 sites. if i remove "by area" then i get the overall rating for both sites and i want to get that showing in the same graph.&lt;/P&gt;

&lt;P&gt;please help a newbie!! &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 19 Oct 2018 13:22:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430733#M40808</guid>
      <dc:creator>QuintonS</dc:creator>
      <dc:date>2018-10-19T13:22:45Z</dc:date>
    </item>
    <item>
      <title>Re: How do you create a line graph which shows 3 values?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430734#M40809</link>
      <description>&lt;P&gt;@QuintonS,&lt;/P&gt;

&lt;P&gt;If are looking for just total over week then, try&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%V")
| chart avg(overall_rating) over week by area
| addtotals
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;STRONG&gt;Updated:&lt;/STRONG&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;  | eval week=relative_time(_time,"@w1")
  | eval week=strftime(week,"%V")
  | eventstats avg(overall_rating) as OVERALL_RATING
  | chart avg(overall_rating),max(OVERALL_RATING) as OVERALL_RATING over week by area
  | rename "avg(overall_rating): *" as *,"OVERALL_RATING : *" as DEL*|foreach DEL*[eval OVERALL_RATING =&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;]|fields - DEL*
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 19 Oct 2018 14:27:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430734#M40809</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2018-10-19T14:27:38Z</dc:date>
    </item>
    <item>
      <title>Re: How do you create a line graph which shows 3 values?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430735#M40810</link>
      <description>&lt;P&gt;Hi Renjith, not looking for the totals.&lt;/P&gt;

&lt;P&gt;output i want should look like the following.&lt;/P&gt;

&lt;P&gt;Week, Site1, Site2, Overall rating&lt;/P&gt;

&lt;P&gt;hope this makes sens?&lt;/P&gt;</description>
      <pubDate>Fri, 19 Oct 2018 14:35:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430735#M40810</guid>
      <dc:creator>QuintonS</dc:creator>
      <dc:date>2018-10-19T14:35:09Z</dc:date>
    </item>
    <item>
      <title>Re: How do you create a line graph which shows 3 values?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430736#M40811</link>
      <description>&lt;P&gt;So is it not Site1_Rating+Site2_Rating? May be a sample data will be helpful. Sorry for that.&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 21:43:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430736#M40811</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2020-09-29T21:43:13Z</dc:date>
    </item>
    <item>
      <title>Re: How do you create a line graph which shows 3 values?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430737#M40812</link>
      <description>&lt;P&gt;i need to provide average of ratings for the client. so i have daily data with a "overal_rating" field. and i also have data per site. So i need to show average overall rating and average overall rating per site in the same graph. cant share sample data unfortunatley..&lt;/P&gt;</description>
      <pubDate>Fri, 19 Oct 2018 14:49:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430737#M40812</guid>
      <dc:creator>QuintonS</dc:creator>
      <dc:date>2018-10-19T14:49:57Z</dc:date>
    </item>
    <item>
      <title>Re: How do you create a line graph which shows 3 values?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430738#M40813</link>
      <description>&lt;P&gt;Okie, calculate this value before chart and add it in chart&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; | eval week=relative_time(_time,"@w1")
 | eval week=strftime(week,"%V")
 | eventstats avg(overall_rating) as OVERALL_RATING
 | chart avg(overall_rating),max(OVERALL_RATING) as OVERALL_RATING over week by area
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 19 Oct 2018 15:14:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430738#M40813</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2018-10-19T15:14:45Z</dc:date>
    </item>
    <item>
      <title>Re: How do you create a line graph which shows 3 values?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430739#M40814</link>
      <description>&lt;P&gt;Added little clean up &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    |rename "avg(overall_rating): *" as *,"OVERALL_RATING : *" as DEL*|foreach DEL*[eval OVERALL_RATING =&amp;lt;&amp;lt;FIELD&amp;gt;&amp;gt;]|fields - DEL*
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 19 Oct 2018 15:16:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430739#M40814</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2018-10-19T15:16:53Z</dc:date>
    </item>
    <item>
      <title>Re: How do you create a line graph which shows 3 values?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430740#M40815</link>
      <description>&lt;P&gt;This is very close, need to do some tweeks. seems to be working.&lt;/P&gt;

&lt;P&gt;Thanks so much for the help! &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 19 Oct 2018 15:32:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430740#M40815</guid>
      <dc:creator>QuintonS</dc:creator>
      <dc:date>2018-10-19T15:32:12Z</dc:date>
    </item>
    <item>
      <title>Re: How do you create a line graph which shows 3 values?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430741#M40816</link>
      <description>&lt;P&gt;You are welcome @QuintonS,. Updated the answer, please accept if it's ok&lt;/P&gt;</description>
      <pubDate>Fri, 19 Oct 2018 16:05:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-do-you-create-a-line-graph-which-shows-3-values/m-p/430741#M40816</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2018-10-19T16:05:41Z</dc:date>
    </item>
  </channel>
</rss>

