topic Re: Chart set range value in Splunk Search

Chart set range value

markgomez00 — Tue, 08 Oct 2013 13:59:48 GMT

Hi,

I have a perfmon counter which is monitoring the SLA, most of the time it's constant in a huge number(millions), and goes in a downward trend which basically indicates that the SLA is about to be breached.

what i want to achieve in the chart/panel is set a range within 0-100, so when the SLA goes down and reached the range <100 range that's the only time it should show in the chart, from 99 down to the lowest value it would reach

my search string is

host=[hostname] index=[index]  counter="SLA violation countdown"  | timechart max(Value) by instance

so far i have tried to add the options:

<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.maximumNumber">100</option>

but nothing shows up on the chart
also if you have better ideas on a better approach, it would be great 🙂
any help would be appreciated, Thanks in advance guys

Re: Chart set range value

dwaddle — Tue, 08 Oct 2013 21:59:43 GMT

For data to appear, the data's value must be within the chart's y-axis limits. If you set the y-axis to have a range of [0,100] then your data must also be [0,100] or it will be drawn "off the chart".

You could normalize your data, if you have an idea of what defines " < 100% ". Say for example anything below 123,456,789 is "abnormal" and we want a linear drop...

<your search> 
| eval sla_percent= if(count >= 123456789,101,((count / 123456789) * 100))

This establishes 123,456,789 widgets / time interval as "101% SLA". Anything above that is still 101% SLA. With the chart's y-axis fixed at [0,100] then the hard-coded 101% value will not be drawn on the chart at all. Anything less than your trigger value is ranged from 0 to 100 linearly. So if you are producing 122,000,000 widgets / time interval then that corresponds to an SLA of 98.82 -- and will appear on the chart.

Note if your chart is a bar or column chart instead of a line or area you may want to hard-code "ideal" at -1 instead of 101 -- so it's drawn "below" the lower range of the y-axis.

Re: Chart set range value

markgomez00 — Thu, 10 Oct 2013 09:18:29 GMT

Thanks @dwaddle, exactly what i needed :), had to set the normal SLA > 100, anything below that is abnormal and is show in the chart