How do you subtract the field values and visualize accordingly?

[dhirendra761]

Hi,

I need to visualize as per attached image.

I have below table :

Memory  ************Size
full Memory *******80000
volatile memory     **8000
Permanents memory ****70000

Description
The full memory of system is 80000 MB.

The volatile memory is 8000, so the permanent memory is 72000 MB.

If there is 70000 permanents on this system, the available memory represents 2000 MB so the system is ≈ 97% full (70000/72000).

I am new in Splunk require your help. Thanks in advance !

[sdchakraborty · Accepted solution]

Hi,

Can you try the below code?

<dashboard theme="dark">
  <label>sid</label>
  <row>
    <panel>
      <viz type="aiam-common-visual-6_4.stacked_bar">
        <search>
          <query>|makeresults 
|  fields - _time  
|eval Total = 80000 , volatile = 8000 , temp_parmenent = Total - volatile , permanent = 70000 , free = temp_parmenent - permanent, dummy_col = "size"
|  table dummy_col,permanent,free,volatile</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="aiam-common-visual-6_4.stacked_bar.bgColor">#f8be34</option>
        <option name="aiam-common-visual-6_4.stacked_bar.dimension1">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.height">500</option>
        <option name="aiam-common-visual-6_4.stacked_bar.label">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.labelColor">black</option>
        <option name="aiam-common-visual-6_4.stacked_bar.labelSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.legendColor">#53a051</option>
        <option name="aiam-common-visual-6_4.stacked_bar.legendSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.position">right</option>
        <option name="aiam-common-visual-6_4.stacked_bar.stack">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltip">0</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipColor">#006d9c</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipbgColor">white</option>
        <option name="aiam-common-visual-6_4.stacked_bar.transbgColor">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.type">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.xaxis">0</option>
        <option name="aiam-common-visual-6_4.stacked_bar.yaxis">0</option>
        <option name="drilldown">none</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>

[dhirendra761]

Your query is more simpler than above and works exactly same.

Thanks for your inputs

[sdchakraborty]

Hi,
Yes its almost same with only difference is my query is preserving the total memory and then divide among sub memories. Anyways glad that it resolves your issue 🙂

Sid

[harishalipaka]

hi @dhirendra761
try this code

<dashboard>
  <label>bar dashboard</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>|makeresults |eval Memory="Full",size=80000 |append[|makeresults |eval Memory="volatile",size=8000] |append[|makeresults |eval Memory="parmanents",size=70000] |table Memory size |transpose header_field=Memory</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked100</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>

[dhirendra761]

Hi @harishalipaka
thank you so much for your input. I got append result for all field values in one bar.

Just for clarififcation, The image having math expression and substractaction accoordingly.
Image represented should be represented as :

The total memory is represented as whole bar (100%=80000)
Permanent memory is 70000 (87.5% of full memory)
Volatile memory is 8000 (10% of full memory)

Then free space will be (80000-(8000+70000) eg 2.5% of full memory).

Can you pease re-sugguested query as per above description.