Splunk Search

How to combine graphs with different left and right axes?

mhtedford
Communicator

I have two graphs. The first shows the number of survey responses by week:
alt text

Here is the search:

index=webex_sentiment 
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
| eval YearWeek=strftime(surveyDate,"%Y-%U") 
| chart  count(Rating) as NumberRatings by YearWeek

The second shows the percentage of negative survey responses by week:
alt text

Here is the search:

index=webex_sentiment 
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
| eval YearWeek=strftime(surveyDate,"%Y-%U") 
| stats  count(Rating) as NumberRatings by YearWeek Rating  
| eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
| eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
| where  Rating=1 OR Rating=2  
| chart  sum(PercentageRatings) as NegativeSentiment by YearWeek

I want to combine these into a single graph, with number of surveys on the left axis and percentage of negative sentiment on the right axis.

0 Karma
1 Solution

cmerriman
Super Champion

try something like this and go into Format>Chart Overlay and grab the NegativeSentiment or TotalRatings as the overlay:

 index=webex_sentiment 
 | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
 | eval YearWeek=strftime(surveyDate,"%Y-%U") 
 | stats  count(Rating) as NumberRatings by YearWeek Rating  
 | eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
 | eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
 | where  Rating=1 OR Rating=2  
 | stats  sum(PercentageRatings) as NegativeSentiment max(TotalRatings) as TotalRatings by YearWeek

View solution in original post

cmerriman
Super Champion

try something like this and go into Format>Chart Overlay and grab the NegativeSentiment or TotalRatings as the overlay:

 index=webex_sentiment 
 | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
 | eval YearWeek=strftime(surveyDate,"%Y-%U") 
 | stats  count(Rating) as NumberRatings by YearWeek Rating  
 | eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
 | eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
 | where  Rating=1 OR Rating=2  
 | stats  sum(PercentageRatings) as NegativeSentiment max(TotalRatings) as TotalRatings by YearWeek

mhtedford
Communicator

That's exactly what I was looking for! Thanks so much.

Here is the final product: http://imgur.com/a/ERVTQ

0 Karma

niketn
Legend

@mhtedford, your queries are the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mhtedford
Communicator

I updated the post, perhaps the edit hasn't gone through yet...

http://imgur.com/a/EbwTK

0 Karma

cmerriman
Super Champion

the two searches you've given are exactly the same. what is supposed to be the difference between them?

0 Karma

mhtedford
Communicator

Fixed @cmerriman

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...