Dashboards & Visualizations

Gauges with dynamic ranges?

leune
Path Finder

I am trying to create a dashboard that contains gauges of which the limits are computed based on the data. Specifically, I would like one search to determine the target, and then a target-20% and a target+20% range. The actual value would then be plotted relative to those ranges.

Is it possible to create dynamic ranges for gauges?

Tags (2)

aljohnson_splun
Splunk Employee
Splunk Employee

This is really old but whatever:

Its much easier to use the gauge command:

alt text

ayme
Splunk Employee
Splunk Employee

One way would be with a subsearch which creates the range values for you. In my example below I calculate max as the number of events from the previous timerange:

index=_internal earliest=-5m sourcetype=splunkd | stats count | gauge count [search sourcetype=splunkd index=_internal earliest=-20m latest=-10m | stats count as max | eval first=0 | eval second=10 | eval third=max/2 | eval fourth=max  | eval range=first+" "+second+" "+third+" "+fourth | return $range]

akshaypillai
Engager

Thanks Ayme - that worked! I was wondering how to get the Max Value populated on the visualization. any pointers for that as well?

0 Karma

leune
Path Finder

I tried going that route, but failed in getting the last part sorted out straight. The eval range.. and return $range is something I didn't know would work. Thanks!

0 Karma

HattrickNZ
Motivator

tks very much for this, exactly what I was looking for:

And just for my reference/clarification.

I get an output like this:
x y1 y2 y3 y4
709 0 10 689.500000 1379

which comes from the seach something like:

x --> stats count | gauge count (the will be the value in the gauge)
y1 --> first (y's are the different ranges in the gauge )
y2 --> second
y3 --> third
y4 --> fourth

I presume you can have more ys?

0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

The path of least resistance is to use sideview, look up the custom module ResultsValueSetter in sideview and your life will be made easy. Your advanced xml will end up looking a bit like:

Search (to establish target and bounds) -> ResultsValueSetter (to set those values as substitutable variables) -> Search (this actually is the search to populate your gauge with the bounds dynamically inserted by the variables) -> chart (this tells the view that it needs to render your results into a chart)

leune
Path Finder

Thank you for the feedback; I haven't really dabbled with SideView, but this seems a good reason to get going on it 😉

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...