Dual Y Axis with Calculated Scale

[ShaneNewman]

I want to take the same data that produces 2 lines on a graph and calculate the second Y axis to be a fraction of the first. (More complected than I originally thought)

This is a timechart so Splunk is grouping by _time, which is summarized in the index by minute. I have used delta to find the grouping time:

delta _time AS delta_time p=1 | eval inbound_mps=(inbound_messages/delta_time) | eval processed_mps=(processed_messages/delta_time)

as delta_time is the total seconds in the grouping… mps=Messages Per Second

Truthfully, there is no reason to have a second chart on the dashboard overlaid, just an axis scaled to the fraction of the Volumes by delta_time for the initial data. Right now it is overlaid and it looks like trash (IMO).

Initially I thought I could use

<param name="charting.data1">hide</param>

to just ghost the data and scale the axis, however that did not work (It just set the axis to 0-100)

XML:

    <module name="HiddenChartFormatter">
      <param name="charting.chart">line</param>
      <param name="charting.data1">view</param>
      <param name="charting.data1.columns">[0,4,5]</param>
      <param name="charting.chart.data">@data1</param>
      <param name="charting.data1.table">@data</param>
      <param name="charting.axisTitleY.text">Messages Per Second (MPS)</param>
      <param name="charting.chart.nullValueMode">connect</param>
      <param name="charting.chart.axisY">@axisY</param>
      <param name="charting.axisTitleY.placement">left</param>
      <param name="charting.axisLabelsY.placement">left</param>
      <param name="charting.chart2">line</param>
      <param name="charting.data2">view</param>
      <param name="charting.data2.columns">[0,1,2]</param>
      <param name="charting.chart2.data">@data2</param>
      <param name="charting.data2.table">@data</param>
      <param name="charting.axisTitleY2.text">Message Volume</param>
      <param name="charting.chart2.nullValueMode">connect</param>
      <param name="charting.axisTitleY2">#axisTitleY</param>
      <param name="charting.chart2.axisY">@axisY2</param>
      <param name="charting.axisTitleY2.placement">right</param>
      <param name="charting.axisLabelsY2.placement">right</param>
      <param name="charting.axisLabelsY2">#axisLabelsY</param>
      <param name="charting.axisLabelsY2.axis">@axisY2</param>
      <param name="charting.layout.axisLabels">[@axisLabelsX,@axisLabelsY2,@axisLabelsY]</param>
      <param name="charting.layout.axisTitles">[@axisTitleX,@axisTitleY,@axisTitleY2]</param>
      <param name="charting.layout.charts">[@chart2,@chart]</param>
      <param name="charting.legend.placement">top</param>
      <param name="charting.axisTitleX.text">Time</param>
    <module name="JobProgressIndicator"/>
      <module name="FlashChart">
        <param name="width">100%</param>
        <module name="Gimp"/>
      </module>
    </module>

[ShaneNewman · Accepted solution]

Looks like this is not doable...