Splunk Search

Chart Help

Hppjet
Path Finder

index="all_eqt" | stats sum(TotalSquareYards) as TSY by ShopOrder DefectDescription| table ShopOrder DefectDescription TSY |sort -TSY | head 10 | chart sum(TSY) over ShopOrder by DefectDescription

I am not able to get the chart to show the top 10 shop orders with TSY instead it just shows the first 10. Please help.

alt text

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index="all_eqt" 
| stats sum(TotalSquareYards) as TSY by ShopOrder DefectDescription
| appendpipe [| stats sum(TSY) as TSY by ShortOrder | sort 10 -TSY | eval isTop10="Y" | eval isTotalRow="Y" ]
| eventstats values(isTop10) as isTop10 by ShortOrder | where isTop10="Y" AND NOT isTotalRow="Y"
| chart sum(TSY) over ShopOrder by DefectDescription

The appendpipe subsearch will get total TSY by ShortOrder, get top 10 from that and flag those ShortOrders. The eventstats will apply the flag on all matching (top 10) ShortOrders. The where clause will just remove all unnecessary results (not in top 10 and those appendpipe results).

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Do you want to show top 10 TSY for each ShopOrder?

0 Karma

Hppjet
Path Finder

I want to show the top 10 shop orders. Then show the sum of the parts that make up the shop order.

0 Karma

niketn
Legend

@Hppjet, were you able to try out any of the answers below? Is your issue resolved?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@Hppjet, after sorting results in descending order of TSY, apply streamstats to count occurrence of ShopOrder field as eventcount and apply filter for eventcount <10:

index="all_eqt" 
| stats sum(TotalSquareYards) as TSY by ShopOrder DefectDescription 
| table ShopOrder DefectDescription TSY 
|  sort - TSY
|  streamstats count as eventcount by ShopOrder
|  where eventcount <= 10
|  chart sum(TSY) over ShopOrder by DefectDescription

Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...