I try to make box plot graph using <viz>
However, My code have this error,
"Error in 'stats' command: The number of wildcards between field specifier '*' and rename specifier 'lowerquartile' do not match. Note: empty field specifiers implies all fields, e.g. sum() == sum(*)"
and My code is this
<viz type="viz_boxplot_app.boxplot">
<search>
<query>index=idx_prd_analysis sourcetype="type:prd_analysis:result" corp="AUS"
| eval total_time = End_time - Start_time
| stats median, min, max, p25 AS lowerquartile, p75 AS upperquartile by total_time
| eval iqr=upperquartile-lowerquartile
| eval lowerwhisker=median-(1.5*iqr)
| eval upperwhisker=median+(1.5*iqr)
</query>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</search>
<option name="drilldown">all</option>
<option name="refresh.display">progressbar</option>
</viz>
I don't use any "eval" or string words at the "stats", But it happend.
How could I solve this problem?
You may need to specify the "total_time" field as the field to return descriptive statistic on instead of using it as a by-field in this search.
Something like this,
index=idx_prd_analysis sourcetype="type:prd_analysis:result" corp="AUS"
| eval
total_time='End_time'-'Start_time'
| stats
median(total_time) as median,
min(total_time) as min,
max(total_time) as max,
p25(total_time) as lowerquartile,
p75(total_time) as upperquartile
| eval
iqr='upperquartile'-'lowerquartile',
scalar=1.5,
lowerwhisker='median'-('scalar'*'iqr'),
upperwhisker='median'+('scalar'*'iqr')
You may need to specify the "total_time" field as the field to return descriptive statistic on instead of using it as a by-field in this search.
Something like this,
index=idx_prd_analysis sourcetype="type:prd_analysis:result" corp="AUS"
| eval
total_time='End_time'-'Start_time'
| stats
median(total_time) as median,
min(total_time) as min,
max(total_time) as max,
p25(total_time) as lowerquartile,
p75(total_time) as upperquartile
| eval
iqr='upperquartile'-'lowerquartile',
scalar=1.5,
lowerwhisker='median'-('scalar'*'iqr'),
upperwhisker='median'+('scalar'*'iqr')
@dtburrows3
Thank you for your help.
It work!