Splunk Search

How to combine graphs with different left and right axes?

mhtedford
Communicator

I have two graphs. The first shows the number of survey responses by week:
alt text

Here is the search:

index=webex_sentiment 
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
| eval YearWeek=strftime(surveyDate,"%Y-%U") 
| chart  count(Rating) as NumberRatings by YearWeek

The second shows the percentage of negative survey responses by week:
alt text

Here is the search:

index=webex_sentiment 
| eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
| eval YearWeek=strftime(surveyDate,"%Y-%U") 
| stats  count(Rating) as NumberRatings by YearWeek Rating  
| eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
| eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
| where  Rating=1 OR Rating=2  
| chart  sum(PercentageRatings) as NegativeSentiment by YearWeek

I want to combine these into a single graph, with number of surveys on the left axis and percentage of negative sentiment on the right axis.

0 Karma
1 Solution

cmerriman
Super Champion

try something like this and go into Format>Chart Overlay and grab the NegativeSentiment or TotalRatings as the overlay:

 index=webex_sentiment 
 | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
 | eval YearWeek=strftime(surveyDate,"%Y-%U") 
 | stats  count(Rating) as NumberRatings by YearWeek Rating  
 | eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
 | eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
 | where  Rating=1 OR Rating=2  
 | stats  sum(PercentageRatings) as NegativeSentiment max(TotalRatings) as TotalRatings by YearWeek

View solution in original post

cmerriman
Super Champion

try something like this and go into Format>Chart Overlay and grab the NegativeSentiment or TotalRatings as the overlay:

 index=webex_sentiment 
 | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") 
 | eval YearWeek=strftime(surveyDate,"%Y-%U") 
 | stats  count(Rating) as NumberRatings by YearWeek Rating  
 | eventstats  sum(NumberRatings) as TotalRatings by YearWeek 
 | eval  PercentageRatings=round(NumberRatings/TotalRatings,3)  
 | where  Rating=1 OR Rating=2  
 | stats  sum(PercentageRatings) as NegativeSentiment max(TotalRatings) as TotalRatings by YearWeek

mhtedford
Communicator

That's exactly what I was looking for! Thanks so much.

Here is the final product: http://imgur.com/a/ERVTQ

0 Karma

niketn
Legend

@mhtedford, your queries are the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mhtedford
Communicator

I updated the post, perhaps the edit hasn't gone through yet...

http://imgur.com/a/EbwTK

0 Karma

cmerriman
Super Champion

the two searches you've given are exactly the same. what is supposed to be the difference between them?

0 Karma

mhtedford
Communicator

Fixed @cmerriman

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...