Dashboards & Visualizations

Dashboard chart - with 3 columns that compare col 1 to col 2 with col 3 showing the deltas.

jrjarcher
New Member

Is the dashboard chart UI element the right thing to use to create a query that will show 3 columns, configured as follows: column 1 shows values for result X, column 2 shows values for result Y, and column 3 shows the deltas between column 1 and column 2.

Any pointers to examples? Thanks!

Tags (1)
0 Karma

jrjarcher
New Member

Here's an image of what I am hoping to create with a Splunk dashboard UI element:

alt text

0 Karma

niketn
Legend

@jrjarcher depending on how you want to present the data, chart will obviously be able to depict the information you are looking for. For example X, Y and X-Y.

Following are two options, 1) Using Chart Overlay where Delta becomes the overlay and (2) Stacked Chart. But there could be several others as well.

alt text

Following is the Simple XML code for run anywhere example which generates data similar to your question and creates series by data1, data2, data3... this could be any of your aggregation key or even time span.

 <dashboard>
  <label>Two series and Delta</label>
  <row>
    <panel>
      <chart>
        <search id="base">
          <query>| makeresults count=10
| fields - _time
| streamstats count as sno
| eval sno="data".sno
| eval X=random(), X=substr(X,1,3), Y=random() ,Y=substr(Y,1,3)
| eval delta=X-Y
| table sno "X" "Y" "delta"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.overlayFields">delta</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <search base="base">
          <query/>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jrjarcher
New Member

This is awesome! Thank you. I might use this as another way to represent the data in my dashboard.

However, I'm looking for something .... more simplistic. I'm sure I'm not explaining myself very well. Visually, I was hoping to show the UI element on the dashboard as follows:

feature test_1 test_2 delta
X. 1.0 2.0. +1.0
Y 8. 3. -5
Z 2.3. 2.0. -0.3

alt text

Just a simple table (I know I said chart in my original question, I'm not sure which element is "best" to use) that has the results of 2 series and the deltas between the series. In a simple table format, almost like a spreadsheet. Is there a dashboard widget that I will do this?

0 Karma

niketn
Legend

@jrjarcher if you want to share a dummy/sample screenshot or whiteboard image, you can use any image sharing site like imgur etc and then post the image using the Image Icon on Splunk Answers or Short cut key Ctrl + G. Please try and confirm as the image that you tried to post does not show up.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jrjarcher
New Member

Here's what I'd like the table to look like, if possible:

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...