topic Box plot error in 'stats' command in Splunk Search

Box plot error in 'stats' command

Questioner — Wed, 20 Dec 2023 04:47:42 GMT

I try to make box plot graph using <viz>

However, My code have this error,

"Error in 'stats' command: The number of wildcards between field specifier '*' and rename specifier 'lowerquartile' do not match. Note: empty field specifiers implies all fields, e.g. sum() == sum(*)"

and My code is this

<viz type="viz_boxplot_app.boxplot">
<search>
<query>index=idx_prd_analysis sourcetype="type:prd_analysis:result" corp="AUS"
      | eval total_time = End_time - Start_time
      | stats median, min, max, p25 AS lowerquartile, p75 AS upperquartile by total_time
      | eval iqr=upperquartile-lowerquartile
      | eval lowerwhisker=median-(1.5*iqr)
      | eval upperwhisker=median+(1.5*iqr)
</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">all</option>
<option name="refresh.display">progressbar</option>
</viz>

I don't use any "eval" or string words at the "stats", But it happend.
How could I solve this problem?

Re: Box plot error in 'stats' command

dtburrows3 — Wed, 20 Dec 2023 05:17:43 GMT

You may need to specify the "total_time" field as the field to return descriptive statistic on instead of using it as a by-field in this search.

Something like this,

index=idx_prd_analysis sourcetype="type:prd_analysis:result" corp="AUS" | eval total_time='End_time'-'Start_time' | stats median(total_time) as median, min(total_time) as min, max(total_time) as max, p25(total_time) as lowerquartile, p75(total_time) as upperquartile | eval iqr='upperquartile'-'lowerquartile', scalar=1.5, lowerwhisker='median'-('scalar'*'iqr'), upperwhisker='median'+('scalar'*'iqr')

Re: Box plot error in 'stats' command

Questioner — Wed, 20 Dec 2023 05:35:14 GMT

@dtburrows3
Thank you for your help.
It work!