topic Re: Creating a line graph that displays raw array by index in All Apps and Add-ons

Creating a line graph that displays raw array by index

erez10121012 — Wed, 30 Sep 2020 01:45:04 GMT

hi
after writ in the search "source="tcp:514" sourcetype="syslog" | chart values(_raw)" i see the results:
values(_raw)
10,20,30,40

how i can displays chart thet x-axis is simple runnung index (1,2,3,4,5...)
and y-axis is the 10,20,30,40 values.?

now i can only seccuss to chart one value by time.
thanks

Re: Creating a line graph that displays raw array by index

Sukisen1981 — Thu, 15 Aug 2019 16:57:24 GMT

try this

 source="tcp:514" sourcetype="syslog" | streamstats count as row| chart values(_raw) by row

Re: Creating a line graph that displays raw array by index

erez10121012 — Thu, 15 Aug 2019 17:35:39 GMT

hi
thanks for the answer
i think the results are good, i want to see linear line
x=1,2,3,4,5......
y=10,20,30,40
please see the picture.
][1]

Re: Creating a line graph that displays raw array by index

erez10121012 — Thu, 15 Aug 2019 18:28:29 GMT

hi
thanks for the help
i dont get the right chart.
please see the picture above.

Re: Creating a line graph that displays raw array by index

Sukisen1981 — Thu, 15 Aug 2019 19:06:11 GMT

i don't understand your requirement you want one straight horizontal line as x axis changes? what you have shown is the event snapshot, it just shows 3 events being indexed..can you clarify more?

Re: Creating a line graph that displays raw array by index

erez10121012 — Thu, 15 Aug 2019 23:14:00 GMT

yes
i receive raw data in form of array: 10,20,30,40
i want to plot it like graph(in this case the results are linear line)
y-10,20,30,40
x-1, 2, 3, 4
for example:
if i rechive one by one( seperate TCP packege ) : 10 then 20 then 30 in , i can plot it by _time.

here i want to plot it by index that i need to create in splunk.

Re: Creating a line graph that displays raw array by index

Sukisen1981 — Fri, 16 Aug 2019 06:40:15 GMT

hi @erez10121012 ,
I have been thinking a bit about your requirement. The chart or stats or most commands will expect a numerical count on the y axis to plot a line/column or whatever else is the chosen viz format. You really can't have a value like 10,20,30,40 as 3 numerical values in the y axis.
But I think what you need is one line each for each packet. The value 10,let us call this pckt1 you can chart this as a line across all your _raw events. Same goes for the other packets. In your events you have values for 4 packets. Try this

    | rex field=_raw "(?<pckt1>.*?)\,+(?<pckt2>.*?)\,+(?<pckt3>.*?)\,+(?<pckt4>.*)"
    |  streamstats count as row 
    |  chart values(pckt1),values(pckt2),values(pckt3),values(pckt4) by row

This way if say pckt1 (which is all showing value of 10) jumps or you have a packet loss , the corresponding line will increase or decrease

Re: Creating a line graph that displays raw array by index

erez10121012 — Sun, 18 Aug 2019 16:42:23 GMT

hi
still a not success to plot an array as function of the INDEX of the array: array(INDEX).
another example is OFFICE EXCEL: when i plot column the x-axis is the running index 1,2,3,4.... and the y-axis is the value.

i have 4000 value on each array, so i prefer not to send each value in different socket.
thanks

Re: Creating a line graph that displays raw array by index

erez10121012 — Sun, 18 Aug 2019 18:03:05 GMT

hi
i success to separate the value, but raw is always ‘1’ and all the data plot in the same line
thanks

Re: Creating a line graph that displays raw array by index

niketn — Sun, 18 Aug 2019 18:53:30 GMT

@erez10121012 for the two raw events in your example how do you want to plot them on chart? Can you add a mock screenshot or whiteboard snap explaining the same. Chart is not the right visualization for display raw data.

You can try out Event Annontation or Chart Tooltip Text as options but I dont think that kind of requirement for raw data makes sense, so please add a mock screenshot of output with some sample data: https://answers.splunk.com/answers/613705/using-dashboard-for-presentation.html

Re: Creating a line graph that displays raw array by index

erez10121012 — Mon, 19 Aug 2019 07:03:45 GMT

thanks niketnilay
each row, for example row number 1, i want to plot graph.
if i take row 1, (i take the first 5 numbers) i want to see something like this:

if it help to solve my problem:
i can send the DATA in other format? for example (-72):(-76): etc

Re: Creating a line graph that displays raw array by index

erez10121012 — Tue, 20 Aug 2019 13:03:20 GMT

Still stuck on this topic, I'd love to get help or direction...

Re: Creating a line graph that displays raw array by index

erez10121012 — Tue, 20 Aug 2019 14:52:01 GMT

hi @Sukisen1981
your solution work, but i need it for 4000 values and the rex function are limit.
can i write function or loop the initelyz the pckt1-4000 ?
in the picture you can see the first 3 value, but now i need 4000.
thanks

Re: Creating a line graph that displays raw array by index

Sukisen1981 — Tue, 20 Aug 2019 15:15:18 GMT

still not clear, how i the above a snapshot of values for row #1?
it looks like a series of values for rows 1-5?

Re: Creating a line graph that displays raw array by index

Sukisen1981 — Tue, 20 Aug 2019 16:51:43 GMT

hi @erez10121012 I apologize if I came out as rude,I didn't mean to.
This is a confusing situation, you can have 4000 lines or 4000 columns, splunk viz limits to 10 K.
BUT
will that be readable for end users?
Either way you are bound to find the chart too cramped. Are you looking for a dashboard panel or just a standalone search viz for this issue?
If you are considering a dashboard panel, I strongly recommend a summary view as a top level panel and then changing it to more details on drill down etc. If you are looking for a standalone search(or a dashboard panel for that matter) I don't think this vizs. are going to be of much help. You can build something technically but the viz will be all cramped and too 'dense' to interpret.
you have 4 values for each event, I suggest considering a pie with treliis view for each of the four

Re: Creating a line graph that displays raw array by index

erez10121012 — Wed, 21 Aug 2019 08:15:46 GMT

@Sukisen1981 <" i don't understand your requirement you want one straight horizontal line as x axis changes? what you have shown is the event snapshot, it just shows 3 events being indexed..can you clarify more? ">

for example , in this picture we see 3 event, i want to take the first event (10,20,30) and plot it as function of generic running index (0,1,2,3....).
the graph of this event look like Diagonal line.

Re: Creating a line graph that displays raw array by index

erez10121012 — Wed, 21 Aug 2019 08:26:33 GMT

maybe you are right. i dont want to plot all the rows in the same time.
i want to plot row 1 for example, but if i plot by _TIME i see one column in Given time.
but i want to plot by _(0,1,2,3,4...)
so for 0 the value is -72
for 1 the value is -76
etc

thanks

Re: Creating a line graph that displays raw array by index

erez10121012 — Wed, 21 Aug 2019 08:38:27 GMT

hi @Sukisen1981
yes im looking for a dashboard panel, the user need to see the plot, if you can see in The picture above:
most of the value is between -75 to -60 , only few peaks are at -40 so the user can see it.

about the vizs: i just try different ways to fine the solution, but still i cant find how to plot the array

Re: Creating a line graph that displays raw array by index

erez10121012 — Wed, 21 Aug 2019 09:05:16 GMT

if it help to solve my problem, i can send to spunk the x axis and y axis in the same array, for example
row 1:
-72,0,-76,1,-84,2 etc
whare
y0,x0,y1,x1 etc

Re: Creating a line graph that displays raw array by index

erez10121012 — Wed, 21 Aug 2019 09:20:48 GMT

another suggestion:
what about use mvexpand to create multiple events based on a multivalue field and plot it by _time.
where time start from 0 in steps of 1 sec, for example?

thanks