topic Re: How to combine graphs with different left and right axes? in Splunk Search

How to combine graphs with different left and right axes?

mhtedford — Mon, 24 Jul 2017 16:36:34 GMT

I have two graphs. The first shows the number of survey responses by week:

Here is the search:

index=webex_sentiment 
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
| eval YearWeek=strftime(surveyDate,"%Y-%U") 
| chart  count(Rating) as NumberRatings by YearWeek

The second shows the percentage of negative survey responses by week:

Here is the search:

index=webex_sentiment 
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
| eval YearWeek=strftime(surveyDate,"%Y-%U") 
| stats  count(Rating) as NumberRatings by YearWeek Rating  
| eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
| eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
| where  Rating=1 OR Rating=2  
| chart  sum(PercentageRatings) as NegativeSentiment by YearWeek

I want to combine these into a single graph, with number of surveys on the left axis and percentage of negative sentiment on the right axis.

Re: How to combine graphs with different left and right axes?

cmerriman — Mon, 24 Jul 2017 17:23:17 GMT

the two searches you've given are exactly the same. what is supposed to be the difference between them?

Re: How to combine graphs with different left and right axes?

mhtedford — Mon, 24 Jul 2017 17:28:39 GMT

Fixed @cmerriman

Re: How to combine graphs with different left and right axes?

niketn — Mon, 24 Jul 2017 17:32:54 GMT

@mhtedford, your queries are the same.

Re: How to combine graphs with different left and right axes?

mhtedford — Mon, 24 Jul 2017 17:36:56 GMT

I updated the post, perhaps the edit hasn't gone through yet...

http://imgur.com/a/EbwTK

Re: How to combine graphs with different left and right axes?

cmerriman — Mon, 24 Jul 2017 17:41:19 GMT

try something like this and go into Format>Chart Overlay and grab the NegativeSentiment or TotalRatings as the overlay:

 index=webex_sentiment 
 | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
 | eval YearWeek=strftime(surveyDate,"%Y-%U") 
 | stats  count(Rating) as NumberRatings by YearWeek Rating  
 | eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
 | eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
 | where  Rating=1 OR Rating=2  
 | stats  sum(PercentageRatings) as NegativeSentiment max(TotalRatings) as TotalRatings by YearWeek

Re: How to combine graphs with different left and right axes?

mhtedford — Mon, 24 Jul 2017 17:47:16 GMT

That's exactly what I was looking for! Thanks so much.

Here is the final product: http://imgur.com/a/ERVTQ