I have a search as follows:
search1 | join type=outer _time [search search2] |
It is rather long and basically does a prediction in the first search and a prediction in the second chart.
This is the data that I get:
_time kpi1 predict_kpi1 kpi2 predict_kpi2
2010-09 179.539643
2010-10 239.270968
2010-11 307.206667 299.002293
2010-12 405.039032 370.322798
...
2018-07 21586.06208 27442.36503
2018-08 21813.79108 28051.52905
2018-09 22041.52008 28660.69308
the problem now that the chart is not doing a stacked area chart for all 4 series in the graph...sigh!!
This is what I am getting.
Ideally I would like to be able to achieve something like this in excel. Is this a splunk limitation because I am using the join
? I mean the data is right and I can take it and do what I want in excel but I can't repeat it in splunk. Can anyone advise on this?
NOTE: see my related question here that got me to this point
Try this
search1 | join type=outer _time [search search2] | fillnull value=0
fills all the blanks with 0 but the stacking still does not work. there is only 97 rows of data. splunk should be abble to handle this?
Hi @HattrickNZ
Was going to try and help reformat your data, but I'm not sure what values are supposed to align with which columns. If you let me know what is supposed to go under kpi1, predict_kpi1, kpi2, and predict_kpi2, I can take care of it for ya.
@ppablo, hope this explains how the sample data aligns.
179 is kpi1
299 is predict_kpi1
21586.06208 is predict_kpi1
27442.36503 is predict_kpi2
I think you meant 299 is kpi2? If yes, then my work is done 🙂
no, kpi2 and predict_kpi2 are blank, they only get values later on but caan't be seen in this sample set.tks