topic Re: How to overlap two bars in a Splunk chart? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274832#M82904 <P>Where shall these numbers be used? Is there a chance to include a table and a visualisation?</P> <P>In this case you can introduce a temporary field like <CODE>eval DisplayTotalEvents = TotalEvents - TotalMatch</CODE> for the bar chart, and use the correct total fields for the table...</P> Thu, 21 Jul 2016 14:15:26 GMT DMohn 2016-07-21T14:15:26Z How to overlap two bars in a Splunk chart? https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274827#M82899 <P>I have this search that counts the times a product has been purchased and the times the same product has been purchased with some other product, in this case product m.<BR /> I want to overlap the TotalEvents upon the TotalMatchs, but the option of stacked bars is just adding up the 2 fields.</P> <P>Can someone help me please?</P> <PRE><CODE>index=main sourcetype=csv source="reglas2.csv" Productos!=m [ search index=main sourcetype=csv source="reglas2.csv" Productos!=m [search index=main sourcetype=csv source="reglas2.csv" Productos=m | fields Id_Transaccion] | fields Productos ] | stats count as TotalEvents by Productos | appendcols [search index=main sourcetype=csv source="reglas2.csv" Productos!=m [search index=main sourcetype=csv source="reglas2.csv" Productos=m | fields Id_Transaccion] | stats count as TotalMatch by Productos]|table Productos TotalMatch TotalEvents </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1617i07D6FB52DC3F3818/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 19 Jul 2016 22:27:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274827#M82899 luna23 2016-07-19T22:27:01Z Re: How to overlap two bars in a Splunk chart? https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274828#M82900 <P>Try area chart?</P> Wed, 20 Jul 2016 01:46:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274828#M82900 sundareshr 2016-07-20T01:46:45Z Re: How to overlap two bars in a Splunk chart? https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274829#M82901 <P>I already tried the area chart and it does overlap, but i want the same result in a bar chart</P> Thu, 21 Jul 2016 13:08:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274829#M82901 luna23 2016-07-21T13:08:51Z Re: How to overlap two bars in a Splunk chart? https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274830#M82902 <P>If you really need to use bar charts, you could try to "cheat" by substracting the field TotalMatch from TotalEvents, and then stacking the fields. In this case you would see correct graphics, but your table results are wrong. </P> <P>Just for the visualisation it can be a usable method still...</P> <PRE><CODE>index=main sourcetype=csv source="reglas2.csv" Productos!=m [ search index=main sourcetype=csv source="reglas2.csv" Productos!=m [search index=main sourcetype=csv source="reglas2.csv" Productos=m | fields Id_Transaccion] | fields Productos ] | stats count as TotalEvents by Productos | appendcols [search index=main sourcetype=csv source="reglas2.csv" Productos!=m [search index=main sourcetype=csv source="reglas2.csv" Productos=m | fields Id_Transaccion] | stats count as TotalMatch by Productos] | eval TotalEvents = TotalEvents - TotalMatch |table Productos TotalMatch TotalEvents </CODE></PRE> Thu, 21 Jul 2016 13:57:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274830#M82902 DMohn 2016-07-21T13:57:57Z Re: How to overlap two bars in a Splunk chart? https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274831#M82903 <P>Thanks DMohn,as you said it, the calculations will be wrong, although the chart will look good.<BR /> But what i am trying to do here is a market basket analisys, so i need to show the correct times a product has been purchased (TotalEvents) and the times a product has been purchased with other product (TotalMatch)</P> Thu, 21 Jul 2016 14:10:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274831#M82903 luna23 2016-07-21T14:10:40Z Re: How to overlap two bars in a Splunk chart? https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274832#M82904 <P>Where shall these numbers be used? Is there a chance to include a table and a visualisation?</P> <P>In this case you can introduce a temporary field like <CODE>eval DisplayTotalEvents = TotalEvents - TotalMatch</CODE> for the bar chart, and use the correct total fields for the table...</P> Thu, 21 Jul 2016 14:15:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274832#M82904 DMohn 2016-07-21T14:15:26Z Re: How to overlap two bars in a Splunk chart? https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274833#M82905 <P>It could be an option, Thanks</P> Thu, 21 Jul 2016 14:18:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlap-two-bars-in-a-Splunk-chart/m-p/274833#M82905 luna23 2016-07-21T14:18:16Z