topic Re: Change the X axis to reflect a size range of the mount point being displayed in panel? in Security

Change the X axis to reflect a size range of the mount point being displayed in panel?

damonmanni — Tue, 29 Sep 2020 14:32:53 GMT

My scenario:
1) I have a dynamic dropdown showing mount points for selection
2) Then I have radio btns to select a time range (30/60 days).
3) Once user selects, I Then graph the disk usage for that mount pt over that time range.

What I need help with is how to have the x axis reflect a size range (in TBs) from 0 to
Disk Usage

For $mount_point$ over the last $days_back$ days

host=mdc4vr1110 OR host=mdc4vr1111 index=os source=df sourcetype=df mount="$mount_point$" | timechart eval(round((avg(storage_used)/1024/1024/1024/1024),2)) by mount
-$days_back$d@d
now

ellipsisNone
45
visible
visible
visible
linear
linear
0
inherit
line
50
10
area
gaps
minmax
0.01
default
shiny
all
0
0
ellipsisEnd
top
Time Span
Terabytes
value
none
0
1
1
standard
absolute
after
0
1
true
false
none
1
0
20
Size
1
0
10
/mcomonline

`

Re: Change the X axis to reflect a size range of the mount point being displayed in panel?

niketn — Tue, 29 Sep 2020 14:32:59 GMT

[Updated] based on details provided.

Since your Y-axis will moreover be fixed range. You can consider edit your timechart panel through Format option. Please set Y-axis
according to your need for example:

Interval = 1 Min Value=0 Max Value=10 Title (Custom) = Mount Size (in TB)
Alternatively, you can try the following in Simple XML

<option name="charting.axisLabelsY.majorUnit">1</option>
<option name="charting.axisTitleY.Text">Miunt Size(TB)</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.maximumNumber">10</option>

PS: You should also explore Gauge Visualizations like Filler Gauge for this use case(current time). Also check out Horizon Chart Custom visualization (historic).

@damonmanni, you are using timechart command which plots _time values on x-axis. So in case you want to show the series values on x-axis you have couple of options
1) Perhaps the more meaningful visualization for you is to have bar chart (since you have 30 or 60 days you will have those many bars)

2) Use chart instead of timechart where you can choose your x-axis value through over clause and y-axis through by clause. You can format _time to YY-mm-dd format or the format of your choice or even use date_mday field extracted by default as per your use case. However, you might have to give a mock of what exactly you want to show on each axis. Also explain a bit "size range (in TBs) from 0 to" in your question for us to assist.

Refer to timechart and chart documentation for understanding their purpose:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Chart

Re: Change the X axis to reflect a size range of the mount point being displayed in panel?

damonmanni — Wed, 21 Jun 2017 04:33:13 GMT

Thank you niketnilay once again for your help and guidance.

Unfortunately, in my haste, I phrased my question improperly and so I apologize to you and all for causing SPL confusion and your time loss.

What I really wanted to ask help on was for the "Y-axis" (not the X-axis). I would like the Y-axis to reflect a value range based on the disk size of the mount-point selected.

Example 1:
1) /mymount-1 is on a 10TB filesystem
2) Its current disk usage is at 7.5TB
3) The X-axis will show the last 30 days of time (as per the timechart cmd)
4) I really want the Y-axis to show from 0 to 10 or say from 5 to 10 representing the 10TB filesystem.
4a) The range from 5 to 10 on the Y-axis would be preferred as it would closer to the 7.5 TB used.

Example 2:
If another mount point/filesystem selected is 3TB in size, then the Y-axis would show from 0 to 5

Again, apologies for having to re-phrasing/re-post this request.

Re: Change the X axis to reflect a size range of the mount point being displayed in panel?

niketn — Wed, 21 Jun 2017 09:30:35 GMT

Hi @damomanni, thanks for providing the details. Dont worry about our time, someone or the other will always be there to assist if you provide right details! 🙂 I have updated the answer, see if it fits your needs.