All Apps and Add-ons
Highlighted

How to add a reference line to an outlier chart created by Machine Learning ToolKit?

New Member

Hi Can we add a reference line to outlier chart created by MLTK. I did try adding by using eval command. But no luck.
any suggestions pls

0 Karma
Highlighted

Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit?

SplunkTrust
SplunkTrust

A look at the docs and all the implementations of said chart in the Machine Language Tool Kit show no way to add another field to it. It pretty specifically needs fields _time, outlier_variable, lowerBound, upperBound so I think all attempts at trying to wedge in another value won't work.

Some other charts allow for a overlay, but this one doesn't seem to.

Happy Splunking,
Rich

0 Karma
Highlighted

Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit?

New Member

@rich7177 - Thanks.
Can you suggest any other visualization by which we can obtain all the same details, time, outlier_variable, lowerBound, upperBound, along with a reference line.

0 Karma
Highlighted

Re: How to add a reference line to an outlier chart created by Machine Learning ToolKit?

Legend

@johnsasikumar you can use regular Area Chart with Overlay option to get similar output and add threshold Area as well. Following is cooked up run anywhere example based on Splunk's _internal index.

alt text
Following is the Simple XML example:

<dashboard>
  <label>Outlier Chart</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| timechart span=10m max(date_second) as responsetime 
| head 1000 
| streamstats window=200 current=true median("responsetime") as median 
| eval absDev=(abs('responsetime'-median)) 
| streamstats window=200 current=true median(absDev) as medianAbsDev 
| eval lowerBound=(median-medianAbsDev*exact(20)), upperBound=(median+medianAbsDev*exact(20)) 
| eval isOutlier=if('responsetime' < lowerBound OR 'responsetime' > upperBound, 1, 0) 
| fields _time, "responsetime", lowerBound, upperBound, isOutlier
| eval threshold=50</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisLabelsY2.majorUnit">1</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.maximumNumber">1</option>
        <option name="charting.axisY2.minimumNumber">1</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">area</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.chart.overlayFields">isOutlier</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"upperBound":"0xAFDEEE","lowerBound":"0xAFDEEE"}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>



| eval message="Happy Splunking!!!"


0 Karma