Dashboards & Visualizations

How do you create a line graph which shows 3 values?

QuintonS
Path Finder

Rookie Question: I am trying to create a line graph showing 3 values. i have the query which works perfectly to show "ratings" per site for each site per week. But i want to show the overall rating for both sites as well.

here is the query i use..

| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%V")
| chart avg(overall_rating) over week by area

area= field name and contains values for 2 sites. if i remove "by area" then i get the overall rating for both sites and i want to get that showing in the same graph.

please help a newbie!! 🙂

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@QuintonS,

If are looking for just total over week then, try

| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%V")
| chart avg(overall_rating) over week by area
| addtotals

Updated:

  | eval week=relative_time(_time,"@w1")
  | eval week=strftime(week,"%V")
  | eventstats avg(overall_rating) as OVERALL_RATING
  | chart avg(overall_rating),max(OVERALL_RATING) as OVERALL_RATING over week by area
  | rename "avg(overall_rating): *" as *,"OVERALL_RATING : *" as DEL*|foreach DEL*[eval OVERALL_RATING =<<FIELD>>]|fields - DEL*

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@QuintonS,

If are looking for just total over week then, try

| eval week=relative_time(_time,"@w1")
| eval week=strftime(week,"%V")
| chart avg(overall_rating) over week by area
| addtotals

Updated:

  | eval week=relative_time(_time,"@w1")
  | eval week=strftime(week,"%V")
  | eventstats avg(overall_rating) as OVERALL_RATING
  | chart avg(overall_rating),max(OVERALL_RATING) as OVERALL_RATING over week by area
  | rename "avg(overall_rating): *" as *,"OVERALL_RATING : *" as DEL*|foreach DEL*[eval OVERALL_RATING =<<FIELD>>]|fields - DEL*

View solution in original post

QuintonS
Path Finder

Hi Renjith, not looking for the totals.

output i want should look like the following.

Week, Site1, Site2, Overall rating

hope this makes sens?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

So is it not Site1_Rating+Site2_Rating? May be a sample data will be helpful. Sorry for that.

0 Karma

QuintonS
Path Finder

i need to provide average of ratings for the client. so i have daily data with a "overal_rating" field. and i also have data per site. So i need to show average overall rating and average overall rating per site in the same graph. cant share sample data unfortunatley..

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Okie, calculate this value before chart and add it in chart

 | eval week=relative_time(_time,"@w1")
 | eval week=strftime(week,"%V")
 | eventstats avg(overall_rating) as OVERALL_RATING
 | chart avg(overall_rating),max(OVERALL_RATING) as OVERALL_RATING over week by area

renjith_nair
SplunkTrust
SplunkTrust

Added little clean up 🙂

    |rename "avg(overall_rating): *" as *,"OVERALL_RATING : *" as DEL*|foreach DEL*[eval OVERALL_RATING =<<FIELD>>]|fields - DEL*
0 Karma

QuintonS
Path Finder

This is very close, need to do some tweeks. seems to be working.

Thanks so much for the help! 🙂

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You are welcome @QuintonS,. Updated the answer, please accept if it's ok

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!