Splunk Search

How to combine graphs with different left and right axes?

mhtedford
Communicator

I have two graphs. The first shows the number of survey responses by week:
alt text

Here is the search:

index=webex_sentiment 
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
| eval YearWeek=strftime(surveyDate,"%Y-%U") 
| chart  count(Rating) as NumberRatings by YearWeek

The second shows the percentage of negative survey responses by week:
alt text

Here is the search:

index=webex_sentiment 
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
| eval YearWeek=strftime(surveyDate,"%Y-%U") 
| stats  count(Rating) as NumberRatings by YearWeek Rating  
| eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
| eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
| where  Rating=1 OR Rating=2  
| chart  sum(PercentageRatings) as NegativeSentiment by YearWeek

I want to combine these into a single graph, with number of surveys on the left axis and percentage of negative sentiment on the right axis.

0 Karma
1 Solution

cmerriman
Super Champion

try something like this and go into Format>Chart Overlay and grab the NegativeSentiment or TotalRatings as the overlay:

 index=webex_sentiment 
 | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
 | eval YearWeek=strftime(surveyDate,"%Y-%U") 
 | stats  count(Rating) as NumberRatings by YearWeek Rating  
 | eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
 | eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
 | where  Rating=1 OR Rating=2  
 | stats  sum(PercentageRatings) as NegativeSentiment max(TotalRatings) as TotalRatings by YearWeek

View solution in original post

cmerriman
Super Champion

try something like this and go into Format>Chart Overlay and grab the NegativeSentiment or TotalRatings as the overlay:

 index=webex_sentiment 
 | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
 | eval YearWeek=strftime(surveyDate,"%Y-%U") 
 | stats  count(Rating) as NumberRatings by YearWeek Rating  
 | eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
 | eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
 | where  Rating=1 OR Rating=2  
 | stats  sum(PercentageRatings) as NegativeSentiment max(TotalRatings) as TotalRatings by YearWeek

mhtedford
Communicator

That's exactly what I was looking for! Thanks so much.

Here is the final product: http://imgur.com/a/ERVTQ

0 Karma

niketn
Legend

@mhtedford, your queries are the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mhtedford
Communicator

I updated the post, perhaps the edit hasn't gone through yet...

http://imgur.com/a/EbwTK

0 Karma

cmerriman
Super Champion

the two searches you've given are exactly the same. what is supposed to be the difference between them?

0 Karma

mhtedford
Communicator

Fixed @cmerriman

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...