topic Re: How do you subtract the field values and visualize accordingly? in All Apps and Add-ons

How do you subtract the field values and visualize accordingly?

dhirendra761 — Thu, 13 Dec 2018 07:09:59 GMT

Hi,

I need to visualize as per attached image.

I have below table :

Memory  ************Size
full Memory *******80000
volatile memory     **8000
Permanents memory ****70000

Description
The full memory of system is 80000 MB.

The volatile memory is 8000, so the permanent memory is 72000 MB.

If there is 70000 permanents on this system, the available memory represents 2000 MB so the system is ≈ 97% full (70000/72000).

I am new in Splunk require your help. Thanks in advance !

Re: How do you subtract the field values and visualize accordingly?

harishalipaka — Thu, 13 Dec 2018 08:19:03 GMT

hi @dhirendra761
try this code

<dashboard>
  <label>bar dashboard</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>|makeresults |eval Memory="Full",size=80000 |append[|makeresults |eval Memory="volatile",size=8000] |append[|makeresults |eval Memory="parmanents",size=70000] |table Memory size |transpose header_field=Memory</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked100</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>

Re: How do you subtract the field values and visualize accordingly?

dhirendra761 — Thu, 13 Dec 2018 09:33:50 GMT

Hi @harishalipaka
thank you so much for your input. I got append result for all field values in one bar.

Just for clarififcation, The image having math expression and substractaction accoordingly.
Image represented should be represented as :

The total memory is represented as whole bar (100%=80000)
Permanent memory is 70000 (87.5% of full memory)
Volatile memory is 8000 (10% of full memory)

Then free space will be (80000-(8000+70000) eg 2.5% of full memory).

Can you pease re-sugguested query as per above description.

Re: How do you subtract the field values and visualize accordingly?

sdchakraborty — Thu, 13 Dec 2018 10:28:43 GMT

Hi,

Can you try the below code?

<dashboard theme="dark">
  <label>sid</label>
  <row>
    <panel>
      <viz type="aiam-common-visual-6_4.stacked_bar">
        <search>
          <query>|makeresults 
|  fields - _time  
|eval Total = 80000 , volatile = 8000 , temp_parmenent = Total - volatile , permanent = 70000 , free = temp_parmenent - permanent, dummy_col = "size"
|  table dummy_col,permanent,free,volatile</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="aiam-common-visual-6_4.stacked_bar.bgColor">#f8be34</option>
        <option name="aiam-common-visual-6_4.stacked_bar.dimension1">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.height">500</option>
        <option name="aiam-common-visual-6_4.stacked_bar.label">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.labelColor">black</option>
        <option name="aiam-common-visual-6_4.stacked_bar.labelSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.legendColor">#53a051</option>
        <option name="aiam-common-visual-6_4.stacked_bar.legendSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.position">right</option>
        <option name="aiam-common-visual-6_4.stacked_bar.stack">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltip">0</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipColor">#006d9c</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipbgColor">white</option>
        <option name="aiam-common-visual-6_4.stacked_bar.transbgColor">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.type">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.xaxis">0</option>
        <option name="aiam-common-visual-6_4.stacked_bar.yaxis">0</option>
        <option name="drilldown">none</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>

Re: How do you subtract the field values and visualize accordingly?

dhirendra761 — Thu, 13 Dec 2018 11:08:04 GMT

Your query is more simpler than above and works exactly same.

Thanks for your inputs

Re: How do you subtract the field values and visualize accordingly?

sdchakraborty — Thu, 13 Dec 2018 11:22:09 GMT

Hi,
Yes its almost same with only difference is my query is preserving the total memory and then divide among sub memories. Anyways glad that it resolves your issue 🙂

Sid