Hi
I have an issue with a graph like this.
I have created a way to make the overlays dynamic. So we can see multiple levels in the image.
But ideally, I want this in trellies.
Maxcount is the overlay
I do this by generating a token, that has all the overlays.
However, if I change this to treilles, it's no good (They all come out in different images).
Ideally, I need them to be grouped Together (By ID). But when you pick trellises, you lose the overlay, and then there is the question of how each graph knows to take what overlay. There is an ID that is the same that might be useful in this case, but I am not sure - any help would be amazing!!!
Below, we can see the overlay in different graphs.
However, when I do it on a small example, the overlays go into one graph - Perhaps it's related to the data?
<panel>
<title>Engine Count With MaxCount per Endpoint_Processing</title>
<chart>
<search>
<query>| mstats avg("mx.grid.endpoint.engine.count") as count WHERE "index"="murex_metrics" span=10s AND "mx.env"="$mx_env$" AND service.name="$serviceName$" AND service.namespace="$serviceNamespace$" AND endpoint.name IN ($endpointName$) AND engine.state IN (processing) BY endpoint.name
| join type=left endpoint.name
[| mstats latest("mx.grid.endpoint.expected_engine.count") prestats=true where index=murex_metrics AND "mx.env"="$mx_env$" AND service.name="$serviceName$" AND service.namespace="$serviceNamespace$" AND endpoint.name IN ($endpointName$) BY endpoint.name
| stats latest("mx.grid.endpoint.expected_engine.count") as desiredCount by endpoint.name
]
| rename endpoint.name as EndPoint desiredCount as MaxCount
| eval {EndPoint}_processing = count
| eval {EndPoint}_MaxCount = MaxCount
| fields - EndPoint count MaxCount | stats values(*) as * by _time</query>
<earliest>$global_time_tok.earliest$</earliest>
<latest>$global_time_tok.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.overlayFields">$Token_CHART_OVERLAY$</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="height">483</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
Hi @robertlynch2020,
As an aside, you can add the hidden fields normally generated by the predict command to instruct SplunkWeb to draw upper and lower control boundaries in both normal and trellis modes. As before, the fields need to be aggregations:
index=_internal component IN (LicenseUsage Metrics SavedSplunker)
| timechart fixedrange=f limit=0 span=5m usenull=f useother=f count by component
| untable _time component count
``` calculate stdev and mean, although you can use any statistics ```
| eventstats stdev(count) as s avg(count) as u by component
``` calculate limits from statistics ```
| eval lcl=max(0, u-s), ucl=u+s
``` add hidden fields to produce river chart boundaries ```
| stats max(count) as count max(lcl) as lcl max(ucl) as ucl values(eval(tostring("lcl"))) as _lowercount values(eval(tostring("count"))) as _predictedcount values(eval(tostring("ucl"))) as _uppercount by _time component
Hi @robertlynch2020,
I'll counter @livehybrid here and note that it should work as long as the overlay fields are aggregations from, e.g., chart, mstats, stats, timechart, or xyseries.
Here's a simplified example using internal logs, timechart, and stats:
index=_internal component IN (LicenseUsage Metrics SavedSplunker)
| timechart fixedrange=f limit=0 span=5m usenull=f useother=f count by component
| untable _time component count
| eventstats latest(count) as maxcount by component
| stats max(count) as count max(maxcount) as maxcount by _time componentI've used timechart and untable as a shortcut for continuous time output. The eventstats command allows using a single field as an overlay that's aggregated by one or more categorical fields. The subsequent stats command converts the pre-binned count and maxcount values into aggregates recognized by trellis mode:
The chart uses a global overlay, but because the value is an aggregate, it varies by split-by field.
Hi @robertlynch2020,
As an aside, you can add the hidden fields normally generated by the predict command to instruct SplunkWeb to draw upper and lower control boundaries in both normal and trellis modes. As before, the fields need to be aggregations:
index=_internal component IN (LicenseUsage Metrics SavedSplunker)
| timechart fixedrange=f limit=0 span=5m usenull=f useother=f count by component
| untable _time component count
``` calculate stdev and mean, although you can use any statistics ```
| eventstats stdev(count) as s avg(count) as u by component
``` calculate limits from statistics ```
| eval lcl=max(0, u-s), ucl=u+s
``` add hidden fields to produce river chart boundaries ```
| stats max(count) as count max(lcl) as lcl max(ucl) as ucl values(eval(tostring("lcl"))) as _lowercount values(eval(tostring("count"))) as _predictedcount values(eval(tostring("ucl"))) as _uppercount by _time component
