I want to take the same data that produces 2 lines on a graph and calculate the second Y axis to be a fraction of the first. (More complected than I originally thought)
This is a timechart so Splunk is grouping by _time, which is summarized in the index by minute. I have used delta to find the grouping time:
delta _time AS delta_time p=1 | eval inbound_mps=(inbound_messages/delta_time) | eval processed_mps=(processed_messages/delta_time)
as delta_time is the total seconds in the grouping… mps=Messages Per Second
Truthfully, there is no reason to have a second chart on the dashboard overlaid, just an axis scaled to the fraction of the Volumes by delta_time for the initial data. Right now it is overlaid and it looks like trash (IMO).
Initially I thought I could use
<param name="charting.data1">hide</param>
to just ghost the data and scale the axis, however that did not work (It just set the axis to 0-100)
XML:
<module name="HiddenChartFormatter">
<param name="charting.chart">line</param>
<param name="charting.data1">view</param>
<param name="charting.data1.columns">[0,4,5]</param>
<param name="charting.chart.data">@data1</param>
<param name="charting.data1.table">@data</param>
<param name="charting.axisTitleY.text">Messages Per Second (MPS)</param>
<param name="charting.chart.nullValueMode">connect</param>
<param name="charting.chart.axisY">@axisY</param>
<param name="charting.axisTitleY.placement">left</param>
<param name="charting.axisLabelsY.placement">left</param>
<param name="charting.chart2">line</param>
<param name="charting.data2">view</param>
<param name="charting.data2.columns">[0,1,2]</param>
<param name="charting.chart2.data">@data2</param>
<param name="charting.data2.table">@data</param>
<param name="charting.axisTitleY2.text">Message Volume</param>
<param name="charting.chart2.nullValueMode">connect</param>
<param name="charting.axisTitleY2">#axisTitleY</param>
<param name="charting.chart2.axisY">@axisY2</param>
<param name="charting.axisTitleY2.placement">right</param>
<param name="charting.axisLabelsY2.placement">right</param>
<param name="charting.axisLabelsY2">#axisLabelsY</param>
<param name="charting.axisLabelsY2.axis">@axisY2</param>
<param name="charting.layout.axisLabels">[@axisLabelsX,@axisLabelsY2,@axisLabelsY]</param>
<param name="charting.layout.axisTitles">[@axisTitleX,@axisTitleY,@axisTitleY2]</param>
<param name="charting.layout.charts">[@chart2,@chart]</param>
<param name="charting.legend.placement">top</param>
<param name="charting.axisTitleX.text">Time</param>
<module name="JobProgressIndicator"/>
<module name="FlashChart">
<param name="width">100%</param>
<module name="Gimp"/>
</module>
</module>
Looks like this is not doable...