<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Adding appendcols to table to produce two curves in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Adding-appendcols-to-table-to-produce-two-curves/m-p/542272#M153605</link>
    <description>&lt;P&gt;I'm creating demand and supply curves which use streamstats to accumulate demand and supply in order to intercept the curves (and thereby visually display the market price). Streamstats is used on the "Volume" field since supply is presented in bands (e.g.&amp;nbsp; progressively adding 1,000 units sold @ $2 and 2,200 units sold @ $3, etc) so I need to progressively add these Volume bands/steps in order to make a positive gradient curve.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| search participant_name ="*" code = "*" offer_type = "Supply"
| where Price &amp;gt;= 0 AND Price &amp;lt; 7
| streamstats sum(Volume) as Cumm1_GJ
| eval Supply_GJ = round(Cumm1_GJ,0)&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;On the other hand, demand again is presented in bands but the curve has a negative gradient. Therefore, I used the reverse command to reverse the actions of streamstats - i.e. starting at 40,000 Volume units demanded&amp;nbsp;@ $0, then 38,000 Volume units demanded&amp;nbsp;@ $1, etc.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| appendcols 
    [ search participant_name ="*" code = "*" offer_type = "Demand" 
    | streamstats sum(Volume) as Cumm2_GJ 
    | reverse 
    | eval Demand_GJ = round(Cumm2_GJ, 0)]
| table Price, Supply_GJ, Demand_GJ&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;This is where I'm stuck. I do not get the two curves I expected to see in Visualization.&lt;/P&gt;</description>
    <pubDate>Wed, 03 Mar 2021 22:49:40 GMT</pubDate>
    <dc:creator>supremefeast</dc:creator>
    <dc:date>2021-03-03T22:49:40Z</dc:date>
    <item>
      <title>Adding appendcols to table to produce two curves</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Adding-appendcols-to-table-to-produce-two-curves/m-p/542272#M153605</link>
      <description>&lt;P&gt;I'm creating demand and supply curves which use streamstats to accumulate demand and supply in order to intercept the curves (and thereby visually display the market price). Streamstats is used on the "Volume" field since supply is presented in bands (e.g.&amp;nbsp; progressively adding 1,000 units sold @ $2 and 2,200 units sold @ $3, etc) so I need to progressively add these Volume bands/steps in order to make a positive gradient curve.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| search participant_name ="*" code = "*" offer_type = "Supply"
| where Price &amp;gt;= 0 AND Price &amp;lt; 7
| streamstats sum(Volume) as Cumm1_GJ
| eval Supply_GJ = round(Cumm1_GJ,0)&lt;/LI-CODE&gt;&lt;P&gt;&lt;BR /&gt;On the other hand, demand again is presented in bands but the curve has a negative gradient. Therefore, I used the reverse command to reverse the actions of streamstats - i.e. starting at 40,000 Volume units demanded&amp;nbsp;@ $0, then 38,000 Volume units demanded&amp;nbsp;@ $1, etc.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| appendcols 
    [ search participant_name ="*" code = "*" offer_type = "Demand" 
    | streamstats sum(Volume) as Cumm2_GJ 
    | reverse 
    | eval Demand_GJ = round(Cumm2_GJ, 0)]
| table Price, Supply_GJ, Demand_GJ&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;This is where I'm stuck. I do not get the two curves I expected to see in Visualization.&lt;/P&gt;</description>
      <pubDate>Wed, 03 Mar 2021 22:49:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Adding-appendcols-to-table-to-produce-two-curves/m-p/542272#M153605</guid>
      <dc:creator>supremefeast</dc:creator>
      <dc:date>2021-03-03T22:49:40Z</dc:date>
    </item>
    <item>
      <title>Re: Adding appendcols to table to produce two curves</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Adding-appendcols-to-table-to-produce-two-curves/m-p/542753#M153745</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232107"&gt;@supremefeast&lt;/a&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Using nonsensical--I'm not an economist--synthetic data generates two intersecting curves:&lt;/P&gt;&lt;LI-CODE lang="javascript"&gt;| makeresults count=1000 
| eval Price=random()
| streamstats count as Volume
| streamstats sum(Volume) as Cumm1_GJ 
| eval Supply_GJ = round(Cumm1_GJ,0) 
| appendcols 
    [| makeresults count=1000 
    | streamstats count as Volume 
    | streamstats sum(Volume) as Cumm2_GJ 
    | reverse 
    | eval Demand_GJ = round(Cumm2_GJ, 0)]
| table Price, Supply_GJ, Demand_GJ&lt;/LI-CODE&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="curves_gj.png" style="width: 958px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/13211i081F419595CFE16F/image-size/large?v=v2&amp;amp;px=999" role="button" title="curves_gj.png" alt="curves_gj.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;Can you provide a small set of sample data?&lt;/P&gt;</description>
      <pubDate>Sun, 07 Mar 2021 21:39:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Adding-appendcols-to-table-to-produce-two-curves/m-p/542753#M153745</guid>
      <dc:creator>tscroggins</dc:creator>
      <dc:date>2021-03-07T21:39:22Z</dc:date>
    </item>
  </channel>
</rss>

