Dashboards & Visualizations

How to convert this into a scatter plot?

msarro
Builder

Here is my code:

index="main" sourcetype="AS-CDR"
|where Called_Number="9999" OR Calling_Number="2155551060" OR Called_Number="2155551060" OR Calling_Number="12155551060" OR Called_Number="+12155551060" OR Calling_Number="+12155551060"
|eval Call_Duration = strptime(Release_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q")
|eval TimeToAnswer= strptime(Answer_Time, "%Y%m%d%H%M%S.%q") - strptime(Start_Time, "%Y%m%d%H%M%S.%q")
|eval NormTermTest=if((Termination_Cause=="016" OR Termination_Cause=="017"),1,0)
|eval CallDurTest=if((Call_Duration>15),1,0)
|eval TimeToAnswerTest=if((TimeToAnswer<30),1,0)
|eval NotRedUnav=if(Redirecting_Reason=="unavailable",0,1)
|eval CallScore=((NormTermTest+NotRedUnav+CallDurTest+TimeToAnswerTest)/4)*100
|head 5
|table _time CallScore 

What I need to do is convert the two resulting columns into a scatter plot, showing the call score discretely over time. Each individual phone call in the system gets a score, but since we don't know when a particular user will call it doesn't really make sense to use a line chart or a bin (there is no set interval). The management is fiercely against using things like bins because they mask data in the dashboard. Any help would really be appreciated.

Thus far pretty much any other type of chart works except the scatter. Basically i'm looking to see time be the x axis, and the call score at the given time be along the y axis.

Tags (2)
1 Solution

Paolo_Prigione
Builder

If scatter is not working, you could try a workaround: set the lines to transparent and show the markers!

  1. save a line-chart report out of your search
  2. create a new dashboard and put the report into it
  3. edit the dashboard xml
  4. then under the <chart> element (simplified xml mode) ...

Insert the following (charting reference in this guide😞

<option name="charting.chart.showMarkers">true</option>
<option name="charting.chart.markerSize">3</option>           
<option name="charting.chart.lineStyle.alpha">0</option>

If this is now working, try to go to advanced xml mode (instructions here). Then under the

<module name="HiddenChartFormatter">
<param name="charting.chart">line</param>

put (beware the tags names are different!):

<param name="charting.chart.showMarkers">true</param>
<param name="charting.chart.markerSize">3</param>             
<param name="charting.chart.lineStyle.alpha">0</param>

Save the dashboard, click on the "Splunk" image top-left to reload them, select your dashboard/view from the menu.

Here's a sample result

test

View solution in original post

Paolo_Prigione
Builder

If scatter is not working, you could try a workaround: set the lines to transparent and show the markers!

  1. save a line-chart report out of your search
  2. create a new dashboard and put the report into it
  3. edit the dashboard xml
  4. then under the <chart> element (simplified xml mode) ...

Insert the following (charting reference in this guide😞

<option name="charting.chart.showMarkers">true</option>
<option name="charting.chart.markerSize">3</option>           
<option name="charting.chart.lineStyle.alpha">0</option>

If this is now working, try to go to advanced xml mode (instructions here). Then under the

<module name="HiddenChartFormatter">
<param name="charting.chart">line</param>

put (beware the tags names are different!):

<param name="charting.chart.showMarkers">true</param>
<param name="charting.chart.markerSize">3</param>             
<param name="charting.chart.lineStyle.alpha">0</param>

Save the dashboard, click on the "Splunk" image top-left to reload them, select your dashboard/view from the menu.

Here's a sample result

test

tedder
Communicator

Time cannot be on the x axis, unfortunately. It appears the largest value for X is about 100, and an epoch starts at a number much larger than that.

If you could convert time to some value on the range of 0..100, that could be charted.

It's a serious drawback to the scatterplot; the line chart does 60% of what we want, but connecting the points is often the wrong thing to do. Plotting points against a time axis is what we really need.

0 Karma

msarro
Builder

Sadly that's not possible as we're relying on time to be used to correlate to other sources. I suppose a line graph without the lines connected would really be what we wanted then but I suppose that's not possible. Oi.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...