topic Re: Bar Chart Line, based stats sum in Splunk Search

Bar Chart Line, based stats sum

markux — Tue, 26 Jul 2016 19:03:59 GMT

Regard's,

I have a bar chart is a project cost of summation. In this chart I need to have two vertical lines where :
Topline is the upper limit and the lower the minimum limit cost of a project. The bottom line is 80 % of the estimated total project cost and the top line represents 120% of that cost

You can enter these two lines in a bar graph without series , as in the image below :

Re: Bar Chart Line, based stats sum

sundareshr — Tue, 26 Jul 2016 19:17:14 GMT

Assuming you have a query like this ... | timechart sum(cost) as summation by something. To this, add the following. and set TopLimit & BottomLimit as overlay values

.... | eval TopLimit=Estimate*1.2 | eval BottomLimit=Estimate*.8

http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/Editdashboardpanelvisualizations#Chart_Overlay

Re: Bar Chart Line, based stats sum

jeremiahc4 — Tue, 26 Jul 2016 19:17:45 GMT

Could use a bit more information to fully understand what you are trying to do specifically, but you can put simple lines across a chart like that with an eval command.

<search terms> | eval top=400000 | eval bottom=300000 | timechart sum(value) as "Total Value" ... max(top) as "Top Line" max(bottom) as "Bottom Line"

In your graph choose column format, then you can choose format and click on Chart overlay and add Top & Bottom limits as overlays. There are also options you could add to a dashboard to do this...

<option name="charting.chart">column</option>
<option name="charting.chart.overlayFields">"Top Line","Bottom Line"</option>

Re: Bar Chart Line, based stats sum

markux — Tue, 26 Jul 2016 19:38:42 GMT

Thank you for sundareshr response .

I have detailed what I'm trying to do below

Re: Bar Chart Line, based stats sum

markux — Tue, 29 Sep 2020 10:23:54 GMT

Hi Jeremiahc4,

What I am tendando do is the following :

sourcetype="relatorioGeral" considerar=Sim esforco="" status_projeto="Execução" codigo != NULL categoria='Projeto' cliente='' gp='*' | dedup codigo | eval min=custo_total_estimado * 0.8 | eval max=custo_total_estimado * 1.2 | stats last(_time) as Periodo, sum(custo_total_estimado) as 'Total Estimado', sum(custo_total_realizado) as 'Total Realizado', sum(custo_total_projetado) as 'Total Projetado', sum(max) as 'Limite Máximo', sum(min) as 'Limite Mínimo'

And choose the columns:

And the result:

Has somehow show these points as lines ?

Re: Bar Chart Line, based stats sum

somesoni2 — Tue, 26 Jul 2016 19:54:23 GMT

Try this workaround (the width of column will get reduced), if output like this is acceptable for you.

sourcetype="relatorioGeral" considerar=Sim esforco="" status_projeto="Execução" codigo != NULL categoria="Projeto" cliente="" gp="" | dedup codigo | eval min=custo_total_estimado  0.8 | eval max=custo_total_estimado * 1.2 | stats last(_time) as Periodo, sum(custo_total_estimado) as "Total Estimado", sum(custo_total_realizado) as "Total Realizado", sum(custo_total_projetado) as "Total Projetado", sum(max) as "Limite Máximo", sum(min) as "Limite Mínimo"
| appendpipe [| eval Periodo=Periodo-1 | eval "Total Estimado"=null() | eval  "Total Realizado"=null() | eval "Total Projetado"=null() ]
| appendpipe [| eval Periodo=Periodo+1 | eval "Total Estimado"=null() | eval  "Total Realizado"=null() | eval "Total Projetado"=null() ]
| sort Periodo

Re: Bar Chart Line, based stats sum

markux — Tue, 26 Jul 2016 20:24:37 GMT

Thanks somesoni2,

I made some changes and got what I needed .

Re: Bar Chart Line, based stats sum

woodcock — Wed, 27 Jul 2016 03:47:13 GMT

Take a look at this excellent Q&A:

https://answers.splunk.com/answers/426394/is-conditional-background-coloring-possible-in-spl.html