topic Re: line chart with 2 sets of numbers in Dashboards & Visualizations

line chart with 2 sets of numbers

a238574 — Wed, 18 Apr 2018 13:41:38 GMT

Ok this has to be easy but for some reason I cant figure it out. I have a query that produces two sets of stats

23 5
45 7
19 2

I would like to see these numbers in a line chart as 2 lines with a single data point for each number. When I try to select line chart for the visualization by default it tries to pick the 1st set of numbers as the x axis. How do you just tell to graph the numbers

Re: line chart with 2 sets of numbers

kmaron — Wed, 18 Apr 2018 14:16:56 GMT

Could you please share your search query (with sensitive data left out)? It will be much easier to help if we can see that.

Re: line chart with 2 sets of numbers

TISKAR — Wed, 18 Apr 2018 14:41:07 GMT

Hello,

If you try by this:

index=_internal | stats count sum(bytes) by version

And then select multiseries mode in formt of the chart

can you add information please?

thanks

Re: line chart with 2 sets of numbers

niketn — Wed, 18 Apr 2018 15:10:45 GMT

@a238574, For plotting two series on chart, you should also have aggregation field name as first first column i.e.

sno     stats1   stats2
sno1    23       5
sno2    45       7
sno3    19       2

So you would ideally need to retain aggregation field name in your final result or need to create one. Please share your current query if you need us to look and correct the same. In order to create a new field one of the ways would be to use streamstats

<yourCurrentSearch>
    | streamstats count as sno 
    | eval sno="sno".sno 
    | table sno <yourFirstStatsField> <yourSecondStatsField>

Following is the run anywhere search based on sample data provided.

| makeresults 
| eval data="23,5;45,7;19,2" 
| makemv data delim=";" 
| mvexpand data 
| makemv data delim="," 
| eval stats1=mvindex(data,0),stats2=mvindex(data,1) 
| fields - _time data 
| streamstats count as sno 
| eval sno="sno".sno 
| table sno stats1 stats2

Please try out and confirm!