<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: bar chart with five search in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105700#M27419</link>
    <description>&lt;P&gt;You should post a new question for this one with some more details.&lt;/P&gt;</description>
    <pubDate>Mon, 29 Oct 2012 16:25:25 GMT</pubDate>
    <dc:creator>sdaniels</dc:creator>
    <dc:date>2012-10-29T16:25:25Z</dc:date>
    <item>
      <title>bar chart with five search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105694#M27413</link>
      <description>&lt;P&gt;I want to create a bar chart with these following search &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;eventtype="et_system_metrics" Stage=A*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

eventtype="et_system_metrics" Stage=D*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

eventtype="et_system_metrics" Stage=O*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

eventtype="et_system_metrics" Stage=R*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

eventtype="et_system_metrics" Stage=S*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The only difference in these search is Stage - so it should display 5 bar with percentage&lt;/P&gt;

&lt;P&gt;I am confused how to arrange these search &lt;span class="lia-unicode-emoji" title=":disappointed_face:"&gt;😞&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;If I display chart like &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;eventtype="et_system_metrics" | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100 | chart values(percentage) by Stage
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I can't see anything.&lt;/P&gt;

&lt;P&gt;How do I display bar chart with above search?&lt;/P&gt;</description>
      <pubDate>Mon, 29 Oct 2012 15:51:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105694#M27413</guid>
      <dc:creator>jangid</dc:creator>
      <dc:date>2012-10-29T15:51:54Z</dc:date>
    </item>
    <item>
      <title>Re: bar chart with five search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105695#M27414</link>
      <description>&lt;P&gt;How does this work for you:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;eventtype="et_system_metrics" | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 by Stage | eval percentage = (count2/count1)*100 | chart values(percentage) by Stage
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 29 Oct 2012 16:02:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105695#M27414</guid>
      <dc:creator>sdaniels</dc:creator>
      <dc:date>2012-10-29T16:02:19Z</dc:date>
    </item>
    <item>
      <title>Re: bar chart with five search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105696#M27415</link>
      <description>&lt;P&gt;Does this give you the table you are expecting:&lt;/P&gt;

&lt;P&gt;eventtype="et_system_metrics" | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 by Stage &lt;/P&gt;

&lt;P&gt;A list of each Stage and a count for each job status?  If so, then you should be very close to getting what you want.&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 12:42:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105696#M27415</guid>
      <dc:creator>sdaniels</dc:creator>
      <dc:date>2020-09-28T12:42:28Z</dc:date>
    </item>
    <item>
      <title>Re: bar chart with five search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105697#M27416</link>
      <description>&lt;P&gt;You are genius &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;BR /&gt;
I used by Stage but with first count&lt;/P&gt;</description>
      <pubDate>Mon, 29 Oct 2012 16:12:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105697#M27416</guid>
      <dc:creator>jangid</dc:creator>
      <dc:date>2012-10-29T16:12:15Z</dc:date>
    </item>
    <item>
      <title>Re: bar chart with five search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105698#M27417</link>
      <description>&lt;P&gt;No genius here...but you can certainly find some at the Apple store.&lt;/P&gt;</description>
      <pubDate>Mon, 29 Oct 2012 16:13:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105698#M27417</guid>
      <dc:creator>sdaniels</dc:creator>
      <dc:date>2012-10-29T16:13:22Z</dc:date>
    </item>
    <item>
      <title>Re: bar chart with five search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105699#M27418</link>
      <description>&lt;P&gt;How DO I set Min/Max value ?&lt;/P&gt;

&lt;P&gt;I am using sideviews and following is not working&lt;/P&gt;

&lt;P&gt;&lt;OBJECT&gt;&lt;PARAM name="charting.axisX.minimumNumber" /&gt;0&lt;BR /&gt;
&lt;PARAM name="charting.axisX.maximumNumber" /&gt;100&lt;/OBJECT&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 29 Oct 2012 16:23:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105699#M27418</guid>
      <dc:creator>jangid</dc:creator>
      <dc:date>2012-10-29T16:23:44Z</dc:date>
    </item>
    <item>
      <title>Re: bar chart with five search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105700#M27419</link>
      <description>&lt;P&gt;You should post a new question for this one with some more details.&lt;/P&gt;</description>
      <pubDate>Mon, 29 Oct 2012 16:25:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/bar-chart-with-five-search/m-p/105700#M27419</guid>
      <dc:creator>sdaniels</dc:creator>
      <dc:date>2012-10-29T16:25:25Z</dc:date>
    </item>
  </channel>
</rss>

