I am trying to create a dashboard that contains gauges of which the limits are computed based on the data. Specifically, I would like one search to determine the target, and then a target-20% and a target+20% range. The actual value would then be plotted relative to those ranges.
Is it possible to create dynamic ranges for gauges?
The path of least resistance is to use sideview, look up the custom module ResultsValueSetter in sideview and your life will be made easy. Your advanced xml will end up looking a bit like:
Search (to establish target and bounds) -> ResultsValueSetter (to set those values as substitutable variables) -> Search (this actually is the search to populate your gauge with the bounds dynamically inserted by the variables) -> chart (this tells the view that it needs to render your results into a chart)
One way would be with a subsearch which creates the range values for you. In my example below I calculate max as the number of events from the previous timerange:
index=_internal earliest=-5m sourcetype=splunkd | stats count | gauge count [search sourcetype=splunkd index=_internal earliest=-20m latest=-10m | stats count as max | eval first=0 | eval second=10 | eval third=max/2 | eval fourth=max | eval range=first+" "+second+" "+third+" "+fourth | return $range]
I tried going that route, but failed in getting the last part sorted out straight. The eval range.. and return $range is something I didn't know would work. Thanks!
tks very much for this, exactly what I was looking for:
And just for my reference/clarification.
I get an output like this:
x y1 y2 y3 y4
709 0 10 689.500000 1379
which comes from the seach something like:
x --> stats count | gauge count (the will be the value in the gauge)
y1 --> first (y's are the different ranges in the gauge )
y2 --> second
y3 --> third
y4 --> fourth
I presume you can have more