Splunk Search

Adding appendcols to table to produce two curves

supremefeast
Observer

I'm creating demand and supply curves which use streamstats to accumulate demand and supply in order to intercept the curves (and thereby visually display the market price). Streamstats is used on the "Volume" field since supply is presented in bands (e.g.  progressively adding 1,000 units sold @ $2 and 2,200 units sold @ $3, etc) so I need to progressively add these Volume bands/steps in order to make a positive gradient curve.

 

| search participant_name ="*" code = "*" offer_type = "Supply"
| where Price >= 0 AND Price < 7
| streamstats sum(Volume) as Cumm1_GJ
| eval Supply_GJ = round(Cumm1_GJ,0)


On the other hand, demand again is presented in bands but the curve has a negative gradient. Therefore, I used the reverse command to reverse the actions of streamstats - i.e. starting at 40,000 Volume units demanded @ $0, then 38,000 Volume units demanded @ $1, etc.

 

| appendcols 
    [ search participant_name ="*" code = "*" offer_type = "Demand" 
    | streamstats sum(Volume) as Cumm2_GJ 
    | reverse 
    | eval Demand_GJ = round(Cumm2_GJ, 0)]
| table Price, Supply_GJ, Demand_GJ

 

This is where I'm stuck. I do not get the two curves I expected to see in Visualization.

Labels (1)
0 Karma

tscroggins
Influencer

@supremefeast 

Using nonsensical--I'm not an economist--synthetic data generates two intersecting curves:

| makeresults count=1000 
| eval Price=random()
| streamstats count as Volume
| streamstats sum(Volume) as Cumm1_GJ 
| eval Supply_GJ = round(Cumm1_GJ,0) 
| appendcols 
    [| makeresults count=1000 
    | streamstats count as Volume 
    | streamstats sum(Volume) as Cumm2_GJ 
    | reverse 
    | eval Demand_GJ = round(Cumm2_GJ, 0)]
| table Price, Supply_GJ, Demand_GJ

curves_gj.png

Can you provide a small set of sample data?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...