Pareto Chart

[kelseycasco]

I would like to make a Pareto chart that shows the sum of how many scrapped pieces were produced by their given reason (such as broken, bent, etc). I am unsure of how to search/setup this chart. Right now I have:

index=wipscrap OR index=componentscrap Department=D2
| chart sum(Scrap) AS totalscrapdept BY "Scrap Reason Description"
| sort - totalscrapdept

which gives me the correct bar graph. How can I show an overlay that correctly represents the data as a Pareto chart? I'm very new to Splunk

[jaime_ramirez]

Hi

You could use the following (although it could be optimized a lot more):

index=wipscrap OR index=componentscrap Department=D2
| chart sum(Scrap) AS totalscrapdept BY "Scrap Reason Description" 
| sort - totalscrapdept
| eventstats sum(totalscrapdept) as total
| eval percent=round((totalscrapdept/total)*100, 3)
| streamstats sum(percent) as percent_pareto
| fields "Scrap Reason Description" totalscrapdept  percent_pareto

And then in visualizations select Column Chart, then Format -> Chart Overlay (select the percent_pareto field and View as Axis [On])

Hope it helps