topic Re: How can I make interpolation between given two points in Splunk, where time variable is not involved? in Splunk Search

How can I make interpolation between given two points in Splunk, where time variable is not involved?

SSwaminathan90 — Wed, 07 Dec 2022 08:19:11 GMT

Hi Team,

Considering the image shared below:- x1 is my x-axis and y1 is my y-axis.

I would like to interpolate values for x1, var1 & var2 and not for y1 as shown below: -

@interpolation, @ scatterplot.

Any leads are welcome here 🙂

Re: How can I make interpolation between given two points in Splunk, where time variable is not involved?

bowesmana — Thu, 08 Dec 2022 02:36:31 GMT

Add this to your SPL

| makecontinuous x1 | filldown var1 var2

Re: How can I make interpolation between given two points in Splunk, where time variable is not involved?

SSwaminathan90 — Tue, 13 Dec 2022 16:00:07 GMT

@bowesmana

Thanks for your suggestion. with that query, I was able to create the below graph. But if you see the boundary lines (green & blue), though it looks like a straight line but not smooth because for every value of xaxis, green & blue line values are computed with the line equation. So my aim is to make the line as smooth as possible.

1st question:- I would like to consider few random points between xaxis value 15 and 130. and interpolate between the random points.

Any leads are welcome on how create a interpolation.

2nd question:- Is it possible to increase the marker size for orange dots and reduce the marker size for blue and green lines.

Any leads are welcome.

Re: How can I make interpolation between given two points in Splunk, where time variable is not involved?

bowesmana — Tue, 13 Dec 2022 23:51:50 GMT

Use streamstats on that data set and reference the blue and green variables

| streamstats window=5 avg(blue) as blue avg(green) as green

where blue and green are the names of your variables

What's the visualisation - scatter or line chart? What does your data table look like?

Re: How can I make interpolation between given two points in Splunk, where time variable is not involved?

SSwaminathan90 — Wed, 14 Dec 2022 06:49:58 GMT

What's the visualisation - scatter or line chart? What does your data table look like?

Ans:- Its a scatter plot. here I would like to increase the marker size for orange dots and reduce marker size for green & blue dots.

My data table looks like as below:-

X	dist	Y
green	130	-0.0051
blue	130	0.0051
orange	130	0.0015
green	129.99	-0.005
blue	129.99	0.005
green	129.98	-0.005
blue	129.98	0.005

Re: How can I make interpolation between given two points in Splunk, where time variable is not involved?

SSwaminathan90 — Wed, 14 Dec 2022 10:40:08 GMT

@bowesmana

Thanks for the suggestion.

But still, I could not able to see the smooth line profile. It is somewhat looks like sawtooth.

Re: How can I make interpolation between given two points in Splunk, where time variable is not involved?

bowesmana — Wed, 14 Dec 2022 22:43:32 GMT

Play around with the window, the bigger the window, the smoother the average will be. However, your Y axis has a very small scale, so even if your y-value goes up by 0.005, it will appear like a bigger jump.

Here's an example that creates dummy data based on your example green/blue/orange numbers. I've extrapolated out further data points.

As you can see the blue/green lines are sawtooth in the scatter, but if you uncomment the last 3 lines, the blue/green lines become smooth.

Does that not happen?

As far as making green/blue lines smaller, it's not possible with the scatter graph

Would a like chart work if you turn the data to a format suitable for a line chart?

| chart values(Y) over dist by X | streamstats window=15 avg(green) as green avg(blue) as blue