All Apps and Add-ons

How do you subtract the field values and visualize accordingly?

dhirendra761
Contributor

Hi,

I need to visualize as per attached image.

I have below table :

Memory  ************Size
full Memory *******80000
volatile memory     **8000
Permanents memory ****70000

Description
The full memory of system is 80000 MB.

The volatile memory is 8000, so the permanent memory is 72000 MB.

If there is 70000 permanents on this system, the available memory represents 2000 MB so the system is ≈ 97% full (70000/72000).

alt text

I am new in Splunk require your help. Thanks in advance !

Tags (1)
0 Karma
1 Solution

sdchakraborty
Contributor

Hi,

Can you try the below code?

<dashboard theme="dark">
  <label>sid</label>
  <row>
    <panel>
      <viz type="aiam-common-visual-6_4.stacked_bar">
        <search>
          <query>|makeresults 
|  fields - _time  
|eval Total = 80000 , volatile = 8000 , temp_parmenent = Total - volatile , permanent = 70000 , free = temp_parmenent - permanent, dummy_col = "size"
|  table dummy_col,permanent,free,volatile</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="aiam-common-visual-6_4.stacked_bar.bgColor">#f8be34</option>
        <option name="aiam-common-visual-6_4.stacked_bar.dimension1">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.height">500</option>
        <option name="aiam-common-visual-6_4.stacked_bar.label">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.labelColor">black</option>
        <option name="aiam-common-visual-6_4.stacked_bar.labelSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.legendColor">#53a051</option>
        <option name="aiam-common-visual-6_4.stacked_bar.legendSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.position">right</option>
        <option name="aiam-common-visual-6_4.stacked_bar.stack">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltip">0</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipColor">#006d9c</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipbgColor">white</option>
        <option name="aiam-common-visual-6_4.stacked_bar.transbgColor">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.type">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.xaxis">0</option>
        <option name="aiam-common-visual-6_4.stacked_bar.yaxis">0</option>
        <option name="drilldown">none</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>

View solution in original post

sdchakraborty
Contributor

Hi,

Can you try the below code?

<dashboard theme="dark">
  <label>sid</label>
  <row>
    <panel>
      <viz type="aiam-common-visual-6_4.stacked_bar">
        <search>
          <query>|makeresults 
|  fields - _time  
|eval Total = 80000 , volatile = 8000 , temp_parmenent = Total - volatile , permanent = 70000 , free = temp_parmenent - permanent, dummy_col = "size"
|  table dummy_col,permanent,free,volatile</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="aiam-common-visual-6_4.stacked_bar.bgColor">#f8be34</option>
        <option name="aiam-common-visual-6_4.stacked_bar.dimension1">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.height">500</option>
        <option name="aiam-common-visual-6_4.stacked_bar.label">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.labelColor">black</option>
        <option name="aiam-common-visual-6_4.stacked_bar.labelSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.legendColor">#53a051</option>
        <option name="aiam-common-visual-6_4.stacked_bar.legendSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.position">right</option>
        <option name="aiam-common-visual-6_4.stacked_bar.stack">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltip">0</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipColor">#006d9c</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipSize">12</option>
        <option name="aiam-common-visual-6_4.stacked_bar.tooltipbgColor">white</option>
        <option name="aiam-common-visual-6_4.stacked_bar.transbgColor">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.type">1</option>
        <option name="aiam-common-visual-6_4.stacked_bar.xaxis">0</option>
        <option name="aiam-common-visual-6_4.stacked_bar.yaxis">0</option>
        <option name="drilldown">none</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </viz>
    </panel>
  </row>
</dashboard>

dhirendra761
Contributor

Your query is more simpler than above and works exactly same.

Thanks for your inputs

0 Karma

sdchakraborty
Contributor

Hi,
Yes its almost same with only difference is my query is preserving the total memory and then divide among sub memories. Anyways glad that it resolves your issue 🙂

Sid

0 Karma

harishalipaka
Motivator

hi @dhirendra761
try this code

<dashboard>
  <label>bar dashboard</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>|makeresults |eval Memory="Full",size=80000 |append[|makeresults |eval Memory="volatile",size=8000] |append[|makeresults |eval Memory="parmanents",size=70000] |table Memory size |transpose header_field=Memory</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">minmax</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked100</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>
Thanks
Harish

dhirendra761
Contributor

Hi @harishalipaka
thank you so much for your input. I got append result for all field values in one bar.

Just for clarififcation, The image having math expression and substractaction accoordingly.
Image represented should be represented as :

The total memory is represented as whole bar (100%=80000)
Permanent memory is 70000 (87.5% of full memory)
Volatile memory is 8000 (10% of full memory)

Then free space will be (80000-(8000+70000) eg 2.5% of full memory).

Can you pease re-sugguested query as per above description.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...