I have two graphs. The first shows the number of survey responses by week:
Here is the search:
index=webex_sentiment
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M")
| eval YearWeek=strftime(surveyDate,"%Y-%U")
| chart count(Rating) as NumberRatings by YearWeek
The second shows the percentage of negative survey responses by week:
Here is the search:
index=webex_sentiment
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M")
| eval YearWeek=strftime(surveyDate,"%Y-%U")
| stats count(Rating) as NumberRatings by YearWeek Rating
| eventstats sum(NumberRatings) as TotalRatings by YearWeek
| eval PercentageRatings=round(NumberRatings/TotalRatings,3)
| where Rating=1 OR Rating=2
| chart sum(PercentageRatings) as NegativeSentiment by YearWeek
I want to combine these into a single graph, with number of surveys on the left axis and percentage of negative sentiment on the right axis.
try something like this and go into Format>Chart Overlay and grab the NegativeSentiment or TotalRatings as the overlay:
index=webex_sentiment
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M")
| eval YearWeek=strftime(surveyDate,"%Y-%U")
| stats count(Rating) as NumberRatings by YearWeek Rating
| eventstats sum(NumberRatings) as TotalRatings by YearWeek
| eval PercentageRatings=round(NumberRatings/TotalRatings,3)
| where Rating=1 OR Rating=2
| stats sum(PercentageRatings) as NegativeSentiment max(TotalRatings) as TotalRatings by YearWeek
try something like this and go into Format>Chart Overlay and grab the NegativeSentiment or TotalRatings as the overlay:
index=webex_sentiment
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M")
| eval YearWeek=strftime(surveyDate,"%Y-%U")
| stats count(Rating) as NumberRatings by YearWeek Rating
| eventstats sum(NumberRatings) as TotalRatings by YearWeek
| eval PercentageRatings=round(NumberRatings/TotalRatings,3)
| where Rating=1 OR Rating=2
| stats sum(PercentageRatings) as NegativeSentiment max(TotalRatings) as TotalRatings by YearWeek
That's exactly what I was looking for! Thanks so much.
Here is the final product: http://imgur.com/a/ERVTQ
@mhtedford, your queries are the same.
I updated the post, perhaps the edit hasn't gone through yet...
the two searches you've given are exactly the same. what is supposed to be the difference between them?
Fixed @cmerriman