topic Re: Get a Chart rendering as when using predict command - upper, middle and lower with transparency in Splunk Search

Get a Chart rendering as when using predict command - upper, middle and lower with transparency

guilmxm — Fri, 07 Mar 2014 14:30:33 GMT

Hi,

Does anyone knows how i could get a chart in simple xml to render as the same it automatically does when using the predit command ?

To illustrate, when using the predict command (whenever you are in inline search or a dashboard you saved), a nice chart is being generated with transparency between lower and upper data:

I have other data i want to chart the same way, let's i have 4 series:

the main serie, as for example cpu consummation
3 series that will represent min, avg and max of previous periods: lower, middle and upper

Currently, the result i have is as expected:

So my goal is to get the same chart result than predict command automatically generates, but the simple xml code have no differences between the one that generates the transparency between ranges and the one that does not...

Thank you very much for your help !

Re: Get a Chart rendering as when using predict command - upper, middle and lower with transparency

martin_mueller — Fri, 07 Mar 2014 14:46:50 GMT

You can hack your way into this visualization by producing the same output as the predict command, Splunk will automagically adapt. Take a look at this:

index=_internal | timechart count | eval mylower = 1000 | eval mypredicted = 2000 | eval myupper = 3000 | eval _lower = "mylower" | eval _upper = "myupper" | eval _predicted = "mypredicted"

By setting the _lower etc. field names, the underlying visualization assumes this is a predict output and paints it as such. Note, this may not be stable in future versions as this internal interface between the command and the visualization certainly can be subject to change.

Re: Get a Chart rendering as when using predict command - upper, middle and lower with transparency

guilmxm — Fri, 07 Mar 2014 14:53:47 GMT

Hi ! Thanks you very very much, so fast so effective 🙂

Works like a charm, i was getting crazy looking for the way Splunk was generating this automatically

Re: Get a Chart rendering as when using predict command - upper, middle and lower with transparency

alacercogitatus — Fri, 07 Mar 2014 15:15:29 GMT

Nice answer! But to use your actual data with timespans, do this:
timechart span=1m avg(cpu) as predicted max(cpu) as upper min(cpu) as lower | eval _lower = "lower" | eval _predicted = "predicted" | eval _upper = "upper"

Re: Get a Chart rendering as when using predict command - upper, middle and lower with transparency

guilmxm — Fri, 07 Mar 2014 16:24:06 GMT

Yes off course thanks, still the essential part of this nice answer concerns the requirement of naming fields (with _lower, _predicted, _upper) as predict does to get Splunk to render the chart as wanted

Re: Get a Chart rendering as when using predict command - upper, middle and lower with transparency

0range — Tue, 29 Apr 2014 08:07:47 GMT

Why does the x-axis become unreadable with this option?

Re: Get a Chart rendering as when using predict command - upper, middle and lower with transparency

martin_mueller — Tue, 29 Apr 2014 09:22:14 GMT

What option are you talking about precisely? The X-Axis seems fine to me using the approach described here.