Splunk Search

Bar Chart Line, based stats sum

markux
Path Finder

Regard's,

I have a bar chart is a project cost of summation. In this chart I need to have two vertical lines where :
Topline is the upper limit and the lower the minimum limit cost of a project. The bottom line is 80 % of the estimated total project cost and the top line represents 120% of that cost

You can enter these two lines in a bar graph without series , as in the image below :
alt text

0 Karma
1 Solution

somesoni2
Revered Legend

Try this workaround (the width of column will get reduced), if output like this is acceptable for you.

sourcetype="relatorioGeral" considerar=Sim esforco="" status_projeto="Execução" codigo != NULL categoria="Projeto" cliente="" gp="" | dedup codigo | eval min=custo_total_estimado  0.8 | eval max=custo_total_estimado * 1.2 | stats last(_time) as Periodo, sum(custo_total_estimado) as "Total Estimado", sum(custo_total_realizado) as "Total Realizado", sum(custo_total_projetado) as "Total Projetado", sum(max) as "Limite Máximo", sum(min) as "Limite Mínimo"
| appendpipe [| eval Periodo=Periodo-1 | eval "Total Estimado"=null() | eval  "Total Realizado"=null() | eval "Total Projetado"=null() ]
| appendpipe [| eval Periodo=Periodo+1 | eval "Total Estimado"=null() | eval  "Total Realizado"=null() | eval "Total Projetado"=null() ]
| sort Periodo

View solution in original post

woodcock
Esteemed Legend
0 Karma

somesoni2
Revered Legend

Try this workaround (the width of column will get reduced), if output like this is acceptable for you.

sourcetype="relatorioGeral" considerar=Sim esforco="" status_projeto="Execução" codigo != NULL categoria="Projeto" cliente="" gp="" | dedup codigo | eval min=custo_total_estimado  0.8 | eval max=custo_total_estimado * 1.2 | stats last(_time) as Periodo, sum(custo_total_estimado) as "Total Estimado", sum(custo_total_realizado) as "Total Realizado", sum(custo_total_projetado) as "Total Projetado", sum(max) as "Limite Máximo", sum(min) as "Limite Mínimo"
| appendpipe [| eval Periodo=Periodo-1 | eval "Total Estimado"=null() | eval  "Total Realizado"=null() | eval "Total Projetado"=null() ]
| appendpipe [| eval Periodo=Periodo+1 | eval "Total Estimado"=null() | eval  "Total Realizado"=null() | eval "Total Projetado"=null() ]
| sort Periodo

markux
Path Finder

Thanks somesoni2,

I made some changes and got what I needed .

0 Karma

jeremiahc4
Builder

Could use a bit more information to fully understand what you are trying to do specifically, but you can put simple lines across a chart like that with an eval command.

<search terms> | eval top=400000 | eval bottom=300000 | timechart sum(value) as "Total Value" ... max(top) as "Top Line" max(bottom) as "Bottom Line"

In your graph choose column format, then you can choose format and click on Chart overlay and add Top & Bottom limits as overlays. There are also options you could add to a dashboard to do this...

<option name="charting.chart">column</option>
<option name="charting.chart.overlayFields">"Top Line","Bottom Line"</option>
0 Karma

markux
Path Finder

Hi Jeremiahc4,

What I am tendando do is the following :

sourcetype="relatorioGeral" considerar=Sim esforco="" status_projeto="Execução" codigo != NULL

categoria='Projeto' cliente='
' gp='*'

| dedup codigo
| eval min=custo_total_estimado * 0.8

| eval max=custo_total_estimado * 1.2
| stats last(_time) as Periodo,

sum(custo_total_estimado) as 'Total Estimado',

sum(custo_total_realizado) as 'Total Realizado',
sum(custo_total_projetado) as 'Total Projetado',
sum(max) as 'Limite Máximo',
sum(min) as 'Limite Mínimo'

And choose the columns:
alt text

And the result:
alt text

Has somehow show these points as lines ?

0 Karma

sundareshr
Legend

Assuming you have a query like this ... | timechart sum(cost) as summation by something. To this, add the following. and set TopLimit & BottomLimit as overlay values

.... | eval TopLimit=Estimate*1.2 | eval BottomLimit=Estimate*.8 

http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/Editdashboardpanelvisualizations#Chart_Overlay

0 Karma

markux
Path Finder

Thank you for sundareshr response .

I have detailed what I'm trying to do below

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...