topic Re: how to find the value where the two lines meet (line chart) in Splunk Search

how to find the value where the two lines meet (line chart)

zoe — Fri, 24 May 2024 07:36:22 GMT

I have the table

x, y1, y2 and plot them in the line chart. how can I find the value where the two lines cross ?

Re: how to find the value where the two lines meet (line chart)

gcusello — Fri, 24 May 2024 07:42:09 GMT

Hi @zoe ,

after a chart there's always a search and some results.

probably you have a search like the following:

<your_search> | timechart count BY key

wher key has two values (value1 and value2)

so you have to run a search like the following:

<your_search> | timechart count BY key | where value1=value2

I could be more detailed, if you could share your search (in text mode, non screenshot!).

Ciao.

Giuseppe

Re: how to find the value where the two lines meet (line chart)

zoe — Fri, 24 May 2024 07:51:34 GMT

Hi Giuseppe,

thanks for the quick reply.

I do not have timechart. I have a table with the fields like x, y1, y2. If I plot x-y1 and x-y2 in line chars, there two lines cross. I need the value on the y1 line is the same like that on the y2 line.

| where value1=value2

This solution would not work, because y1 and y2 do not have the same field values. I need to find the cross of there two artifical lines.

Re: how to find the value where the two lines meet (line chart)

gcusello — Fri, 24 May 2024 08:18:01 GMT

Hi @zoe ,

even if you don't use timechart, I suppose that you are charting two fields value (y1 and y2), you have to compare the two fields in the where condition.

| where y1=y2

or, if they are similar but ton the same:

| where y1-y2<1 OR y2-y1<1

whwre 1 is the sensibility you want to use in your search.

Ciao.

Giuseppe

Re: how to find the value where the two lines meet (line chart)

tscroggins — Mon, 27 May 2024 14:18:17 GMT

Hi @zoe,

Building on @gcusello's response, you can find the intersections by looking for sign changes in dy:

| eval dy=y2-y1 | autoregress dy | where dy==0 OR abs(dy)/dy!=abs(dy_p1)/dy_p1 | fields - dy dy_p1

The selected point depends on the sort order of the data.

You can use this alone or as part of an annotation search in a dashboard.

We don't know the functions that generated the lines, and we're not performing a regression, but this provide a quick estimation.

Re: how to find the value where the two lines meet (line chart)

emdaax — Mon, 27 May 2024 16:03:54 GMT

Hi @zoe,

building on previous suggestions from "gcusello & tscroggins" , especially that sometimes y1 and y2 might not be exactly equal but rather close to each other, I would use the following method to find the closest intersections:

| eval diff=abs(y1 - y2) | sort diff | head 1 | table _time, y1, y2, diff

From there, you can use another diff (if needed) to calculate the actual difference between the numbers stored in the y1 and y2 fields.

Search Ref:

best regards,

Re: how to find the value where the two lines meet (line chart)

tscroggins — Mon, 27 May 2024 18:32:38 GMT

That will give you one solution, but the other is more generalized:

x	y1	y2
21	866	919
60	125	100

If we find the intersections outside Splunk we get:

x ~ 20.315, y ~ 906.2
x ~ 59.685, y ~ 118.8