How to add a reference line to an outlier chart created by Machine Learning ToolKit?

johnsasikumar — Tue, 21 May 2019 02:17:53 GMT

Hi Can we add a reference line to outlier chart created by MLTK. I did try adding by using eval command. But no luck.
any suggestions pls

Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit?

Richfez — Tue, 21 May 2019 13:26:35 GMT

A look at the docs and all the implementations of said chart in the Machine Language Tool Kit show no way to add another field to it. It pretty specifically needs fields _time, outlier_variable, lowerBound, upperBound so I think all attempts at trying to wedge in another value won't work.

Some other charts allow for a overlay, but this one doesn't seem to.

Happy Splunking,
Rich

Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit?

johnsasikumar — Tue, 21 May 2019 15:00:35 GMT

@rich7177 - Thanks.
Can you suggest any other visualization by which we can obtain all the same details, time, outlier_variable, lowerBound, upperBound, along with a reference line.

Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit?

niketn — Wed, 22 May 2019 05:59:09 GMT

@johnsasikumar you can use regular Area Chart with Overlay option to get similar output and add threshold Area as well. Following is cooked up run anywhere example based on Splunk's _internal index.

Following is the Simple XML example:

<dashboard>
  <label>Outlier Chart</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| timechart span=10m max(date_second) as responsetime 
| head 1000 
| streamstats window=200 current=true median("responsetime") as median 
| eval absDev=(abs('responsetime'-median)) 
| streamstats window=200 current=true median(absDev) as medianAbsDev 
| eval lowerBound=(median-medianAbsDev*exact(20)), upperBound=(median+medianAbsDev*exact(20)) 
| eval isOutlier=if('responsetime' < lowerBound OR 'responsetime' > upperBound, 1, 0) 
| fields _time, "responsetime", lowerBound, upperBound, isOutlier
| eval threshold=50</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisLabelsY2.majorUnit">1</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.maximumNumber">1</option>
        <option name="charting.axisY2.minimumNumber">1</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">area</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.overlayFields">isOutlier</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"upperBound":"0xAFDEEE","lowerBound":"0xAFDEEE"}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>

topic Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit? in All Apps and Add-ons

How to add a reference line to an outlier chart created by Machine Learning ToolKit?

Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit?

Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit?

Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit?