Dashboards & Visualizations

How to add a MLTK Visualization to a Splunk dashboard?

sebastien07
Engager

I would like to add an outliers' chart from the Machine learning visualizations to my splunk dashboard. The visualization itself is not available in the dashboard studio, and I can't find any documentations for it. Running my query in the search tab works fine because it detects what visualization i want to use automatically.

My query: 

 

 

 

index=xxx sourceServiceName="xxx" cn1="xxx"
| bucket _time span=1h
| stats count by _time 
| sort - count 
| eventstats median("count") as median  
| eval absDev=(abs('count'-median)) 
| eventstats median(absDev) as medianAbsDev  
| eval lowerBound=(median-medianAbsDev*exact(8)), upperBound=(median+medianAbsDev*exact(8)) 
| eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0)  
| fields _time, "count", lowerBound, upperBound, isOutlier, *

 

 

 

 

I tried replacing fields with "table" but wouldn't fix it. Any help is appreciated.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

<viz type="Splunk_ML_Toolkit.OutliersViz">

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use classic SimpleXML dashboards or wait until Studio catches up - you could be waiting for some time though

0 Karma

sebastien07
Engager

Also would like to try that, but i can't find the name of the outlier's chart to use for the SimpleXML

 
 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

<viz type="Splunk_ML_Toolkit.OutliersViz">
0 Karma

sebastien07
Engager

I think this could work. I'm not used to working with the XML editor for dashboards.
Any idea why this would fail to spit out the results?

<dashboard version="1.1">
<label>test-webtraffic</label>
  <row>
    <chart> 
      <search>
        <query>index=xxx sourceServiceName="xxx" cn1="xxx" | bucket _time span=1h | stats count by _time | sort - count | eventstats median("count") as median | eval absDev=(abs('count' -median)) | eventstats median(absDev) as medianAbsDev | eval lowerBound=(median-medianAbsDev*exact(8)), upperBound=(median+medianAbsDev*exact(8)) | eval isOutlier=if('count' &lt; lowerBound OR 'count' &gt; upperBound, 1, 0) | fields _time, "count", lowerBound, upperBound, isOutlier, *
        </query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <viz type="Splunk_ML_Toolkit.OutliersViz"></viz>
    </chart>  
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...