Splunk Search

Adding appendcols to table to produce two curves

supremefeast
Observer

I'm creating demand and supply curves which use streamstats to accumulate demand and supply in order to intercept the curves (and thereby visually display the market price). Streamstats is used on the "Volume" field since supply is presented in bands (e.g.  progressively adding 1,000 units sold @ $2 and 2,200 units sold @ $3, etc) so I need to progressively add these Volume bands/steps in order to make a positive gradient curve.

 

| search participant_name ="*" code = "*" offer_type = "Supply"
| where Price >= 0 AND Price < 7
| streamstats sum(Volume) as Cumm1_GJ
| eval Supply_GJ = round(Cumm1_GJ,0)


On the other hand, demand again is presented in bands but the curve has a negative gradient. Therefore, I used the reverse command to reverse the actions of streamstats - i.e. starting at 40,000 Volume units demanded @ $0, then 38,000 Volume units demanded @ $1, etc.

 

| appendcols 
    [ search participant_name ="*" code = "*" offer_type = "Demand" 
    | streamstats sum(Volume) as Cumm2_GJ 
    | reverse 
    | eval Demand_GJ = round(Cumm2_GJ, 0)]
| table Price, Supply_GJ, Demand_GJ

 

This is where I'm stuck. I do not get the two curves I expected to see in Visualization.

Labels (1)
0 Karma

tscroggins
Influencer

@supremefeast 

Using nonsensical--I'm not an economist--synthetic data generates two intersecting curves:

| makeresults count=1000 
| eval Price=random()
| streamstats count as Volume
| streamstats sum(Volume) as Cumm1_GJ 
| eval Supply_GJ = round(Cumm1_GJ,0) 
| appendcols 
    [| makeresults count=1000 
    | streamstats count as Volume 
    | streamstats sum(Volume) as Cumm2_GJ 
    | reverse 
    | eval Demand_GJ = round(Cumm2_GJ, 0)]
| table Price, Supply_GJ, Demand_GJ

curves_gj.png

Can you provide a small set of sample data?

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...