Dashboards & Visualizations
Highlighted

Gauges with dynamic ranges?

Path Finder

I am trying to create a dashboard that contains gauges of which the limits are computed based on the data. Specifically, I would like one search to determine the target, and then a target-20% and a target+20% range. The actual value would then be plotted relative to those ranges.

Is it possible to create dynamic ranges for gauges?

Tags (2)
0 Karma
Highlighted

Re: Gauges with dynamic ranges?

Splunk Employee
Splunk Employee

The path of least resistance is to use sideview, look up the custom module ResultsValueSetter in sideview and your life will be made easy. Your advanced xml will end up looking a bit like:

Search (to establish target and bounds) -> ResultsValueSetter (to set those values as substitutable variables) -> Search (this actually is the search to populate your gauge with the bounds dynamically inserted by the variables) -> chart (this tells the view that it needs to render your results into a chart)
Highlighted

Re: Gauges with dynamic ranges?

Path Finder

Thank you for the feedback; I haven't really dabbled with SideView, but this seems a good reason to get going on it 😉

0 Karma
Highlighted

Re: Gauges with dynamic ranges?

Splunk Employee
Splunk Employee

One way would be with a subsearch which creates the range values for you. In my example below I calculate max as the number of events from the previous timerange:

index=_internal earliest=-5m sourcetype=splunkd | stats count | gauge count [search sourcetype=splunkd index=_internal earliest=-20m latest=-10m | stats count as max | eval first=0 | eval second=10 | eval third=max/2 | eval fourth=max  | eval range=first+" "+second+" "+third+" "+fourth | return $range]
Highlighted

Re: Gauges with dynamic ranges?

Path Finder

I tried going that route, but failed in getting the last part sorted out straight. The eval range.. and return $range is something I didn't know would work. Thanks!

0 Karma
Highlighted

Re: Gauges with dynamic ranges?

Motivator

tks very much for this, exactly what I was looking for:

And just for my reference/clarification.

I get an output like this:
x y1 y2 y3 y4
709 0 10 689.500000 1379

which comes from the seach something like:

x --> stats count | gauge count (the will be the value in the gauge)
y1 --> first (y's are the different ranges in the gauge )
y2 --> second
y3 --> third
y4 --> fourth

I presume you can have more ys?

0 Karma
Highlighted

Re: Gauges with dynamic ranges?

Engager

Thanks Ayme - that worked! I was wondering how to get the Max Value populated on the visualization. any pointers for that as well?

0 Karma
Highlighted

Re: Gauges with dynamic ranges?

Splunk Employee
Splunk Employee

This is really old but whatever:

Its much easier to use the gauge command:

alt text