Splunk query for simple bar chart dashboard - data-visualization

I am getting data from snowflake in to Splunk using Splunk DB Connect. This is just 4 lines of data for a demo purpose. Below is Splunk data ( SELECT * FROM example_database. table)
EMP_ID EMP_NAME EMP_SALARY
1 John 3000
2 Greg 3200
3 Peter 1200
4 Mark 2000
I want to create a simple bar dashboard in Splunk which display emp_name and emp_salary on x and y axis respectively. I am using following query in Slplunk search and reporting
source="check" "EMP_NAME" "EMP_SALARY" | top EMP_SALARY
But its showing me bar with equal hights (Should be of different heights as salaries are different). Any suggestion what I am doing wrong in query? Thanks for the help :)

The top command sees four salaries with one person earning each so they're each 25%. That's why the graph is flat, but that's OK because top is not what is needed here. Use top when you want to find the most common values of a field or set of fields. Be aware that top also discards fields so use with caution. For graphing, try the chart command, instead.
| makeresults
| eval _raw="EMP_ID EMP_NAME EMP_SALARY
1 John 3000
2 Greg 3200
3 Peter 1200
4 Mark 2000"
| multikv forceheader=1
| chart max(EMP_SALARY) as EMP_SALARY over EMP_NAME

Related

Using a group by or something similar using Splunk rex

If we have data like this in the splunk logs -
DepId EmpName
100 Jon
100 Mike
100 Tony
200 Mary
200 Jim
Is there a way to display the records with only one line for the repeating DepIds.
So for example,something like below"
DepId EmpName
100 Jon
Mike
Tony
200 Mary
Jim.
Once you have the DepId and EmpName fields extracted, grouping them is done using the stats command.
| stats values(EmpName) as Names by DepId
Let us know if you need help extracting the fields. Perhaps that's why "Splunk rex" is in the title?

Oracle SQL: how to call created columns (alias) for pivot tables in a subquery

This is my first question in this community. It has helped me a lot before, so thank you all for being out there!
I have a problem with ORACLE PLSQL, I'm trying to create a pivot table that counts the number of people that are in a given salary range. I want cities as rows and salary_range as columns. My problem is when I select a column alias for the pivot table.
In table A I have the rows of all employees and their salaries, and in table B, I have their city. Both of them are linked by a key column named id_dpto. First, I join both tables selecting employee names, salaries, and cities. Second, I use CASE WHEN to create the range of salaries (less than 1000 and between 1000 and 2500 dollars) and give it the column alias SALARY_RANGE. Until here, everything is ok and the code runs perfectly.
My problem is on the third step. I use a subquery and PIVOT command to create the pivot to count by cities and salary_range, but when I use the select command in the alias it doesn't work, my error message is "'F'.'SALARY_RANGE' INVALID IDENTIFYER". Can you help me what is the proper way to select a created column (salary_range) in a pivot table? I've tried both, with the F after the from and without it.
Initial data base
| Name | salary | city |
| ---- | ------ | ------ |
|john | 999 | NY |
|adam | 500 | NY |
|linda | 1500 | NY |
|Matt | 2000 | London |
|Joel | 1500 | London |
Desired result:
city
salary less than 1000
salary between 1000 and 2500
NY
2
1
London
0
2
My code:
SELECT F.SALARY_RANGE, F.CITY
FROM (SELECT A.NAMES,
A.SALARY,
C.CITY,
CASE
WHEN SALARY < 1000 THEN 'LESS THAN 1000'
WHEN SALARY < 2500 THEN 'BETWEEN 1000 AND 2500'
END AS SALARY_RANGE FROM EMPLOYEES A
LEFT JOIN XXX B ON A.ID_DPTO = B.ID_DPTO) F
PIVOT
(COUNT(SALARY_RANGE)
FOR SALARY_RANGE IN ('LESS THAN 1000', 'BETWEEN 1000 AND 2500')
)
Thanks for helping me!
I think you should use * and exclude SALARY and NAMES from subquery:
SELECT *
FROM (SELECT B.CITY,
CASE
WHEN SALARY < 1000 THEN
'LESS THAN 1000'
WHEN SALARY < 2500 THEN
'BETWEEN 1000 AND 2500'
END AS SALARY_RANGE
FROM EMPLOYEES A
LEFT JOIN XXX B
ON A.ID_DPTO = B.ID_DPTO) F
PIVOT(COUNT(SALARY_RANGE)
FOR SALARY_RANGE IN('LESS THAN 1000', 'BETWEEN 1000 AND 2500'))

Solving Logical Questions Using SQL

I am trying to solve a problem for a fun work exercise showing that SQL can be used to solve it. It is a puzzle that goes as follows:
Successfully navigating the waters during sea voyages is a challenging task. A captain’s most important decision is selecting the right crew for the voyage. A mix of different skill sets are required to sail the ship efficiently, navigate to the destination, and fish for food along the way.
Table 1 shows a list of crew members that are available for you to hire for the voyage. Each crew member demands a salary for the voyage and has different skill levels of Fishing, Sailing, and Navigation.
In order for your journey to be successful, you must have a cumulative skill of 15 or more in each of the three skill categories from all of your chosen crew members. You may choose as many crew members as you like.
Question: What is the minimum achievable cost for the voyage?"
I would say I am what I would consider an intermediate to advanced (depending on the situation) SQL user.
Not asking for an answer per-say but I have thought about the best way to solve and I was first thinking using a WHILE loop in some way. I have create a table to hold the data and added a 'salary_ranking' column (below). I am curious if anyone has any tips or suggestions on routes to go? I would like to use something I have never used before but also am trying to get to the most efficient answer.
Here is the data (I added the last column):
NAME FISHING SAILING NAVIGATION SALARY SALARY_RANK
---------- ----------- ----------- ----------- ----------- -----------
Amy 3 5 1 46000 3
Bill 1 2 5 43000 2
Carl 3 4 2 47000 4
Dan 4 3 1 36000 1
Eva 4 2 2 43000 2
Fred 1 3 4 55000 5
Greg 3 1 5 68000 8
Henry 5 4 2 64000 7
Ida 3 3 3 60000 6
(9 rows affected)
This is a CTE version, where I first create test data, then run a recursive query, using a MaxID to prevent it doing all the permutations.
declare #t table(Id int, NAME varchar(10), FISHING int, SAILING int, NAVIGATION int, SALARY int)
insert #t values (1,'Amy',3,5,1,46000)
,(2,'Bill',1,2,5,43000 )
,(3,'Carl',3,4,2,47000)
,(4,'Dan',4,3,1,36000)
,(5,'Eva',4,2,2,43000)
,(6,'Fred',1,3,4,55000)
,(7,'Greg',3,1,5,68000)
,(8,'Henry',5,4,2,64000)
,(9,'Ida',3,3,3,60000 )
;with cte as (
select convert(varchar(1000),name) as crew, fishing, sailing, navigation, salary, ID as MaxID from #t
union all
select convert(varchar(1000),cte.crew+', '+ t.name), cte.fishing+t.fishing, cte.sailing+t.sailing, cte.navigation+t.navigation, cte.salary+t.salary, t.ID
from #t t
join cte on t.ID>cte.MaxID
)
select top 1 crew,fishing,sailing,navigation,salary
from cte
where fishing>=15 and sailing>=15 and navigation>=15
order by salary
result is:
crew fishing sailing navigation salary
Amy, Bill, Carl, Greg, Henry 15 16 15 268000

SQL Sum count based on an identifier

Assume I have a table with the following data:
Name TransID Cost
---------------------------------------
Susan 1 10
Johnny 2 10
Johnny 3 9
Dave 4 10
I want to find a way to sum the Costs per name (assume the Names are unique) so that I get a table like this:
Name Cost
---------------------------------------
Susan 10
Johnny 19
Dave 10
Any help is appreciated.
This is relatively straightforward: you need to use a GROUP BY clause in your query:
SELECT Name,SUM(Cost)
FROM MyTable
GROUP BY Name

SQL Reports - sorting an column based on the date mentioned in another column adjacent to it

It would be great if someone can help me out. I am new to SQL.
This is what my table data is
table name: emp
e_no e_name e_jobrole position promotion_date
1 Robin Sales CEO 01/01/2012
1 Robin Sales CFO 20/01/2010
2 Jackman Sales - S1 EMP 01/04/2009
4 Sheldon Marketing MGR 15/08/2012
4 Sheldon Marketing SNRMGR 01/01/2011
4 Sheldon Marketing MGR 01/01/2011
3 Arnold Marketing CEO 09/09/2009
5 Emmy Marketing SNRMGR 08/08/2008
6 Penny Admin SNRMGR 05/05/2012
6 Penny Admin MGR 09/09/2007
By ordering through the date these guys promoted, I need to capture the previous position held by the employee and adjacent to that current position. Is this possible ?
Below is what I required as Output
e_no e_name e_job prev_pos curr_pos promotion_date
1 Robin Sales CFO CEO 01/01/2012
2 Jackman Sales - S1 Not Available EMP 01/04/2009
4 Sheldon Marketing MGR MGR 15/08/2012
3 Arnold Marketing Not Available CEO 09/09/2009
5 Emmy Marketing Not Available SNRMGR 08/08/2008
6 Penny Admin MGR SNRMGR 05/05/2012
EDIT: I seem to have been proven wrong just seconds after posting :P
I don't think you can do that in one query (except using a complicated stored procedure).
How about getting the data into an application (in Java, or whatever you would like) and then parse the data from the oldest data, and keeping track of the "previous position" of each employee. Then, whenever you get to one that you've already got a "previous position" for you can insert that into the table, and update the "previous position" (and if you haven't seen her before, set the "previous position" to null/"none"/""/etc).
Would that be useful, or would it have to be all done on the DB?
Something like this should work. The combination of WHERE and HAVING may need some adjustment.
select
c.e_no,
c.e_name,
c.e_job,
p.position as prev_position,
c.position as curr_position,
c.promotion_date
from
emp c
inner join
emp p
on
c.e_no=p.e_no
group by
c.e_no,
c.e_name,
c.e_job,
p.position as prev_position,
c.position as curr_position,
where
p.promotion_date < c.promotion_date
having
max(p.promotion_date),
max(c.promotion_date)