topic Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization? in Splunk Search

What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

woodcock — Sat, 23 Nov 2019 07:02:40 GMT

I am doing it with Pie Chart and Trellis but that starts paginating at 20 and there is no way to expand that (JIRAs = SPL-143101 and SPL-176965). Ideally, I'd like to do it with a built-in visualization (maybe there is a way to hack a Scatter Chart or a Bubble Chart?) but if that is not possible, what is the best Mod Viz app to do it from Splunkbase? Ideally it would sort them from worst to best like the Service Analyzer in ITSI. Actually, a tightly stacked single-value visualization like that would work, too. Have any of you custom-built a Service Analyzer view in core Splunk somehow?

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

niketn — Mon, 25 Nov 2019 09:42:50 GMT

@woodcock Service Analyzer kind of view from ITSI is possible in core Splunk

either with Line/Area Chart with series compare legends (refer to one of my older answers: https://answers.splunk.com/answers/752153/building-a-dashboard-to-help-tune-our-network-sens.html)
or else through Horizon Chart Custom Viz. See if one of these fits your needs.

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

awmorris — Mon, 25 Nov 2019 13:01:57 GMT

I used a Bubble Chart (or Scatter Chart) and set all my bubbles to the same size. Key chart configs include:

X axis interval : 1
Mark Min size : 1
Mark Max size : 17

Key to the success of the graph are the 1st 3 columns...

Column 1 should correspond to the value that you want colored. In my case, i used four: Okay, Caution, Concern & Critical
Column 2 is your X value
Column 3 is your Y value

| windbag 
| eval lenSample=len(sample) 
| eval positionStr="Position "+position 
| eval health = case(lenSample<20,"Okay",lenSample<30,"Caution",lenSample<40,"Concern",lenSample>=0,"Critical") 
| eval y=trunc(position/10)+1 
| eval x=trunc(position%10)+1
| table health,x,y, positionStr

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

woodcock — Mon, 25 Nov 2019 17:42:42 GMT

BONUS POINTS for the use of windbag to generate sample event data!

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

woodcock — Mon, 25 Nov 2019 19:06:56 GMT

I think that perhaps you are not understanding what I mean by the Service Analyzer View in ITSI. I am talking about this:
https://docs.splunk.com/Documentation/ITSI/4.4.0/User/ServiceAnalyzer
If you take a look at the MOST EXCELLENT answer provided by @awmorris, he is getting exactly what I mean. I looked at your link and it seems like you are more answering how to see an outlier or swim lane view in ITSI, which is not the ask.

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

woodcock — Mon, 25 Nov 2019 20:49:30 GMT

It works better like this:

| windbag 
| head 100
| eval lenSample=len(sample) 
| stats avg(lenSample) AS lenSample BY lang
| streamstats count AS position
| eval position = position - 1
| eval y = 0 - (trunc(position/10) + 1) 
| eval x = position%10 + 1 
| eval health = case(lenSample<20,"Okay",lenSample<30,"Caution",lenSample<40,"Concern",lenSample>=0,"Critical") 
| table health x y lang

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

woodcock — Mon, 09 Jan 2023 20:06:06 GMT

OK, I am working with Pie Charts and Trellis now that I finally figured out how to make the drilldown work. There are 2 only-documented-one-place tokens and another not-documented-anywhere one. I discovered these by copying my dashboard into the Dashboard Examples app and using <form script="event_token_browser.js">. For any of you struggling with dashboard tokens, this is a MUST HAVE tool:
.../en-US/app/simple_xml_examples/custom_event_tokens

They should get documented other places besides
the one place that I found 2 of them:
https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/VisualizationTrellis

$trellis.split.<trellis_field_name>$
$trellis.name$
$trellis.value$

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

woodcock — Tue, 03 Dec 2019 17:13:28 GMT

The idea is to have something that is future-proof such that if I add a new thing that they new thing shows up as a new visualization element without me having to do anything, kind of like when a new Service is defined in ITSI and it magically shows up on the Service Analyzer page.

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

efavreau — Tue, 31 Dec 2019 17:47:54 GMT

@woodcock The answer was up-voted, but not accepted. Oversight?

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

efavreau — Tue, 31 Dec 2019 17:49:49 GMT

@woodcock Good find. Here's a tip: Provided one has the Dashboard Examples app already installed, one can leave their dashboard where ever they want, and pull resources from other installed apps. So that JavaScript can be pulled from its app, like this:
<form script="simple_xml_examples:event_token_browser.js">

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

woodcock — Tue, 31 Dec 2019 18:07:21 GMT

None of the answers works for me so I am hoping for another answer.

Re: What is the best way to get 100ish Greeen/Yellow/Red circles as tightly as possible in a visualization?

niketn — Tue, 26 May 2020 18:43:44 GMT

@woodcock how about this answer: https://answers.splunk.com/answers/529004/is-there-a-way-to-display-more-than-20-charts-at-a.html#answer-816673