Dashboards & Visualizations

Dual Y Axis with Calculated Scale

ShaneNewman
Motivator

I want to take the same data that produces 2 lines on a graph and calculate the second Y axis to be a fraction of the first. (More complected than I originally thought)

This is a timechart so Splunk is grouping by _time, which is summarized in the index by minute. I have used delta to find the grouping time:

delta _time AS delta_time p=1 | eval inbound_mps=(inbound_messages/delta_time) | eval processed_mps=(processed_messages/delta_time)

as delta_time is the total seconds in the grouping… mps=Messages Per Second

Truthfully, there is no reason to have a second chart on the dashboard overlaid, just an axis scaled to the fraction of the Volumes by delta_time for the initial data. Right now it is overlaid and it looks like trash (IMO).

Initially I thought I could use

<param name="charting.data1">hide</param>

to just ghost the data and scale the axis, however that did not work (It just set the axis to 0-100)

XML:

    <module name="HiddenChartFormatter">
      <param name="charting.chart">line</param>
      <param name="charting.data1">view</param>
      <param name="charting.data1.columns">[0,4,5]</param>
      <param name="charting.chart.data">@data1</param>
      <param name="charting.data1.table">@data</param>
      <param name="charting.axisTitleY.text">Messages Per Second (MPS)</param>
      <param name="charting.chart.nullValueMode">connect</param>
      <param name="charting.chart.axisY">@axisY</param>
      <param name="charting.axisTitleY.placement">left</param>
      <param name="charting.axisLabelsY.placement">left</param>
      <param name="charting.chart2">line</param>
      <param name="charting.data2">view</param>
      <param name="charting.data2.columns">[0,1,2]</param>
      <param name="charting.chart2.data">@data2</param>
      <param name="charting.data2.table">@data</param>
      <param name="charting.axisTitleY2.text">Message Volume</param>
      <param name="charting.chart2.nullValueMode">connect</param>
      <param name="charting.axisTitleY2">#axisTitleY</param>
      <param name="charting.chart2.axisY">@axisY2</param>
      <param name="charting.axisTitleY2.placement">right</param>
      <param name="charting.axisLabelsY2.placement">right</param>
      <param name="charting.axisLabelsY2">#axisLabelsY</param>
      <param name="charting.axisLabelsY2.axis">@axisY2</param>
      <param name="charting.layout.axisLabels">[@axisLabelsX,@axisLabelsY2,@axisLabelsY]</param>
      <param name="charting.layout.axisTitles">[@axisTitleX,@axisTitleY,@axisTitleY2]</param>
      <param name="charting.layout.charts">[@chart2,@chart]</param>
      <param name="charting.legend.placement">top</param>
      <param name="charting.axisTitleX.text">Time</param>
    <module name="JobProgressIndicator"/>
      <module name="FlashChart">
        <param name="width">100%</param>
        <module name="Gimp"/>
      </module>
    </module>
0 Karma
1 Solution

ShaneNewman
Motivator

Looks like this is not doable...

View solution in original post

0 Karma

ShaneNewman
Motivator

Looks like this is not doable...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...