topic Re: Graph sizing in Dashboards & Visualizations

Graph sizing

TheOnlyOne — Thu, 25 Oct 2018 09:23:44 GMT

Hello,
we get Data from a Windows Server, i have change the interval from every 1minute to 10 minutes.
Thats enough to get valid informations.

Now we have a Problem with the graph, there are some gaps in it.
At the moment the X Xis is set to minutes.

is it possible to fill out the gaps?

Re: Graph sizing

renjith_nair — Thu, 25 Oct 2018 10:55:14 GMT

Does the visualization connect help?

<option name="charting.chart.nullValueMode">connect</option>

Re: Graph sizing

TheOnlyOne — Thu, 25 Oct 2018 11:48:38 GMT

Where can i insert this Option? in the search directly=?

Re: Graph sizing

TheOnlyOne — Thu, 25 Oct 2018 11:53:20 GMT

Ok i have found the option to display the source. The connect option dosent help

Re: Graph sizing

FrankVl — Fri, 26 Oct 2018 07:46:12 GMT

Can you share the search that generates this graph? You may need to tweak the span setting on the timechart command, to match the frequency at which the data comes in.

Re: Graph sizing

TheOnlyOne — Fri, 26 Oct 2018 08:28:54 GMT

Hi Frank,
this is the search: index="xd" SessionState="Active"
Is very simple, i will get the active Session in CITRIX. I have installed the CITRIX 7 Template in Splunk.
I have modifyed the interval on the Splunk Forwarder to get every 10 Minutes the active Sessions.

Re: Graph sizing

TheOnlyOne — Fri, 26 Oct 2018 08:31:23 GMT

Hi Frank,
this is my search: index="xd" SessionState="Active"
I will get the Active Sessions in CITRIX. I have installed the CITRIX 7 Template.
The Splunk Forwarder send every 10 Minutes new logs.

Re: Graph sizing

FrankVl — Fri, 26 Oct 2018 08:34:41 GMT

Just that search alone will not get you that graph. Don't you have a timechart in there somewhere?

Re: Graph sizing

TheOnlyOne — Fri, 26 Oct 2018 08:37:33 GMT

Maybe this help you:

  <title>XenApp Active Sessions</title>
  <chart>
    <search>
      <query>| pivot XenAppSessions RootObject count(RootObject) AS Sessions SPLITROW _time AS _time PERIOD minute SORT 0 _time ROWSUMMARY 0 COLSUMMARY 0 SHOWOTHER 1</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.abbreviation">none</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.abbreviation">none</option>
    <option name="charting.axisY.maximumNumber">80</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.abbreviation">none</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">area</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.chart.overlayFields">AvgOverall</option>
    <option name="charting.drilldown">none</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.mode">standard</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.lineWidth">2</option>
    <option name="trellis.enabled">0</option>
    <option name="trellis.scales.shared">1</option>
    <option name="trellis.size">large</option>
  </chart>
</panel>

Re: Graph sizing

FrankVl — Fri, 26 Oct 2018 08:42:28 GMT

Guess it is because of the PERIOD minute part. So the results get bucketed per minute, since you only have data once every 10 minutes, you have empty buckets, resulting in those gaps in the graph.

Changing it to PERIOD hour probably gets rid of the gaps, but then you'll loose some detail I think (not very familiar with pivot).

Re: Graph sizing

TheOnlyOne — Fri, 26 Oct 2018 08:46:35 GMT

It is a bit strange, when i set to PERIOD minute, i get the correct Session number. When i change to PERIOD hour, i get strange numbers. Normal Numbers are arround 200 with PERIOD minute, with PERIOD hour i get 800 or more.

Re: Graph sizing

FrankVl — Fri, 26 Oct 2018 09:18:27 GMT

I guess that is because 1h contains multiple imports and it does a count. So you probably get the sum of the sessioncounts from the various inputs?

Not sure if there is any way to make this work properly when your import frequency does not align with the pivot PERIOD. Maybe someone with more pivot experience can say something on that.