Splunk Search

Adding appendcols to table to produce two curves

supremefeast
Observer

I'm creating demand and supply curves which use streamstats to accumulate demand and supply in order to intercept the curves (and thereby visually display the market price). Streamstats is used on the "Volume" field since supply is presented in bands (e.g.  progressively adding 1,000 units sold @ $2 and 2,200 units sold @ $3, etc) so I need to progressively add these Volume bands/steps in order to make a positive gradient curve.

 

| search participant_name ="*" code = "*" offer_type = "Supply"
| where Price >= 0 AND Price < 7
| streamstats sum(Volume) as Cumm1_GJ
| eval Supply_GJ = round(Cumm1_GJ,0)


On the other hand, demand again is presented in bands but the curve has a negative gradient. Therefore, I used the reverse command to reverse the actions of streamstats - i.e. starting at 40,000 Volume units demanded @ $0, then 38,000 Volume units demanded @ $1, etc.

 

| appendcols 
    [ search participant_name ="*" code = "*" offer_type = "Demand" 
    | streamstats sum(Volume) as Cumm2_GJ 
    | reverse 
    | eval Demand_GJ = round(Cumm2_GJ, 0)]
| table Price, Supply_GJ, Demand_GJ

 

This is where I'm stuck. I do not get the two curves I expected to see in Visualization.

Labels (1)
0 Karma

tscroggins
Influencer

@supremefeast 

Using nonsensical--I'm not an economist--synthetic data generates two intersecting curves:

| makeresults count=1000 
| eval Price=random()
| streamstats count as Volume
| streamstats sum(Volume) as Cumm1_GJ 
| eval Supply_GJ = round(Cumm1_GJ,0) 
| appendcols 
    [| makeresults count=1000 
    | streamstats count as Volume 
    | streamstats sum(Volume) as Cumm2_GJ 
    | reverse 
    | eval Demand_GJ = round(Cumm2_GJ, 0)]
| table Price, Supply_GJ, Demand_GJ

curves_gj.png

Can you provide a small set of sample data?

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...