Splunk Search

bar chart with five search

jangid
Builder

I want to create a bar chart with these following search

eventtype="et_system_metrics" Stage=A*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

eventtype="et_system_metrics" Stage=D*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

eventtype="et_system_metrics" Stage=O*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

eventtype="et_system_metrics" Stage=R*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

eventtype="et_system_metrics" Stage=S*  | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100

The only difference in these search is Stage - so it should display 5 bar with percentage

I am confused how to arrange these search 😞

If I display chart like

eventtype="et_system_metrics" | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 | eval percentage = (count2/count1)*100 | chart values(percentage) by Stage

I can't see anything.

How do I display bar chart with above search?

Tags (2)
0 Karma
1 Solution

sdaniels
Splunk Employee
Splunk Employee

How does this work for you:

eventtype="et_system_metrics" | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 by Stage | eval percentage = (count2/count1)*100 | chart values(percentage) by Stage

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

How does this work for you:

eventtype="et_system_metrics" | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 by Stage | eval percentage = (count2/count1)*100 | chart values(percentage) by Stage

sdaniels
Splunk Employee
Splunk Employee

You should post a new question for this one with some more details.

0 Karma

jangid
Builder

How DO I set Min/Max value ?

I am using sideviews and following is not working

0
100

0 Karma

sdaniels
Splunk Employee
Splunk Employee

No genius here...but you can certainly find some at the Apple store.

0 Karma

jangid
Builder

You are genius 🙂
I used by Stage but with first count

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Does this give you the table you are expecting:

eventtype="et_system_metrics" | stats count(eval(JOBSTATUS="FINISHED")) as count1, count(eval(JOBSTATUS="PENDING")) as count2 by Stage

A list of each Stage and a count for each job status? If so, then you should be very close to getting what you want.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...