topic Re: Calculated values showing wrong results. I have the search string attached, what am I doign wrong, here in Splunk Search

Calculated values showing wrong results. I have the search string attached, what am I doign wrong, here

rajendra_b — Mon, 16 Feb 2015 14:09:36 GMT

source =/opt/data/splunkLogs/order_transaction.log | eval TotalOrders=if(match(OrderStatus,"In Progress"),count,0) | eval CompOrders=if(match(OrderStatus,"Complete"),count,0) | eval ErrOrders=if(match(OrderStatus,"In Error"),count,0) | eval InProgOrders=(TotalOrders - CompOrders - ErrOrders)

I want to calculate these values from the events:
Total Orders = All orders with In progress status.
Complete Orders = All orders with Complete status.
Orders in Error = All orders with In Error status.
Inpogress Orders = TotalOrders - CompleteOrders - InErrorOrders

Re: Calculated values showing wrong results. I have the search string attached, what am I doign wrong, here

MuS — Mon, 16 Feb 2015 14:31:35 GMT

Hi rajendra_b,

use either eval TotalOrders=if(match(OrderStatus,"In Progress"),count,"0")
or eval TotalOrders=if(match(OrderStatus,"In Progress"),count,null())

Hope this helps ...

cheers, MuS

Re: Calculated values showing wrong results. I have the search string attached, what am I doign wrong, here

rajendra_b — Mon, 16 Feb 2015 20:54:45 GMT

Thanks for responding. I modified it like below and it works now. However when I use this in Pie chart the values are only displayed when you hover the mouse on it, I want it to display on the panel as well. How can we do that.

source =/opt/data/splunkLogs/order_transaction.log | dedup OrderId | stats count(eval(OrderStatus="In Progress")) AS InProgOrders, count(eval(OrderStatus="Complete")) AS CompOrders, count(eval(OrderStatus="In Error")) AS ErrOrders | eval TotalOrders=(InProgOrders + CompOrders + ErrOrders) | table TotalOrders, CompOrders, InProgOrders, ErrOrders

Re: Calculated values showing wrong results. I have the search string attached, what am I doign wrong, here

ramdaspr — Tue, 17 Feb 2015 02:52:13 GMT

You can only show percentages along with labels but not the counts

    <option name="charting.chart.showPercent">true</option>

Re: Calculated values showing wrong results. I have the search string attached, what am I doign wrong, here

MuS — Tue, 17 Feb 2015 06:19:07 GMT

Hi, this is indeed possible if you use some tricks 😉

Take a look at this answer http://answers.splunk.com/answers/91517/displaying-count-as-label-in-pie-graph.html or at this app https://apps.splunk.com/app/1161/

cheers, MuS

Re: Calculated values showing wrong results. I have the search string attached, what am I doign wrong, here

rajendra_b — Tue, 17 Feb 2015 19:20:47 GMT

MuS,
Thanks a lot for the suggestions. The Percentage is being displayed, however the count is not. I am trying different ways to render the count. Here is my query just in case.

source =/opt/data/splunkLogs/order_transaction.log | dedup OrderId | stats count(eval(OrderStatus="In Progress")) AS InProgress, count(eval(OrderStatus="Complete")) AS Complete, count(eval(OrderStatus="In Error")) AS Error |  transpose

Re: Calculated values showing wrong results. I have the search string attached, what am I doign wrong, here

rajendra_b — Tue, 17 Feb 2015 19:22:03 GMT

Thanks a lot for the help Ramdaspr. The Percentage works.

Re: Calculated values showing wrong results. I have the search string attached, what am I doign wrong, here

rajendra_b — Tue, 17 Feb 2015 20:07:21 GMT

Finally this works. Thank you all for the help. This displays the count as well.

source =/opt/data/splunkLogs/order_transaction.log | dedup OrderId | top OrderStatus | eval OrderStatus=OrderStatus." :".count

Used this to display percentage in the XML as provided earlier.

<option name="charting.chart.showPercent">true</option>