topic Re: Chart Help in Splunk Search

Chart Help

Hppjet — Thu, 16 Nov 2017 19:15:40 GMT

I am not able to get the chart to show the top 10 shop orders with TSY instead it just shows the first 10. Please help.

Re: Chart Help

niketn — Thu, 16 Nov 2017 19:31:58 GMT

@Hppjet, after sorting results in descending order of TSY, apply streamstats to count occurrence of ShopOrder field as eventcount and apply filter for eventcount <10:

index="all_eqt" 
| stats sum(TotalSquareYards) as TSY by ShopOrder DefectDescription 
| table ShopOrder DefectDescription TSY 
|  sort - TSY
|  streamstats count as eventcount by ShopOrder
|  where eventcount <= 10
|  chart sum(TSY) over ShopOrder by DefectDescription

Please try out and confirm.

Re: Chart Help

somesoni2 — Thu, 16 Nov 2017 19:34:25 GMT

Do you want to show top 10 TSY for each ShopOrder?

Re: Chart Help

Hppjet — Thu, 16 Nov 2017 19:40:30 GMT

I want to show the top 10 shop orders. Then show the sum of the parts that make up the shop order.

Re: Chart Help

somesoni2 — Thu, 16 Nov 2017 20:03:20 GMT

Give this a try

index="all_eqt" 
| stats sum(TotalSquareYards) as TSY by ShopOrder DefectDescription
| appendpipe [| stats sum(TSY) as TSY by ShortOrder | sort 10 -TSY | eval isTop10="Y" | eval isTotalRow="Y" ]
| eventstats values(isTop10) as isTop10 by ShortOrder | where isTop10="Y" AND NOT isTotalRow="Y"
| chart sum(TSY) over ShopOrder by DefectDescription

The appendpipe subsearch will get total TSY by ShortOrder, get top 10 from that and flag those ShortOrders. The eventstats will apply the flag on all matching (top 10) ShortOrders. The where clause will just remove all unnecessary results (not in top 10 and those appendpipe results).

Re: Chart Help

niketn — Fri, 24 Nov 2017 04:33:59 GMT

@Hppjet, were you able to try out any of the answers below? Is your issue resolved?