Dashboards & Visualizations

Need to generate 2 Graphs (Bar chart and tine-series) on based on 2 categories

rsoni35
New Member

index=epaas_epaas2_idx ns=xyz365 (app_name="abc" OR app_name="xyz" OR app_name="lmn" OR app_name="deg") method!=GET (process=start OR (process=end AND (status="500"OR status="429" OR status="506"))) NOT("C360-GraphiQL-Postman") NOT("C360-GraphiQL-UI") NOT(MATCHBOX) NOT(TEST)
| bucket span=h _time | eval app_name = replace(app_name,"-a","")
| eval app_name = replace(app_name, "-b","")
| stats count(eval(process="start")) as total count(eval(process="end")) as error by _time app_name
| eval rate=round ((1-(error/total))*100,4)
| xyseries _time app_name rate error
| sort _time app_name error

rsoni35_0-1614355965604.png

 

 

Query: I want to generate the chart based on Error and rate overlapping each other. 

I am getting issue when applying Trellis, its not overlapping based on Error and rate. instead its generating individual chart separately.  I am looking like above is mentioned in image. 

Labels (3)
0 Karma

tscroggins
Influencer

In your example search, app_name is the set {abc, xyz, lmn, deg}. If your producation data contains app_name values like foo-a or bar-b, you can leave your eval commands in place, but I'll remove them here.

xyseries only works with three fields, but you can easily resummarize your data with timechart:

index=epaas_epaas2_idx ns=xyz365 (app_name="abc" OR app_name="xyz" OR app_name="lmn" OR app_name="deg") method!=GET (process=start OR (process=end AND (status="500"OR status="429" OR status="506"))) NOT("C360-GraphiQL-Postman") NOT("C360-GraphiQL-UI") NOT(MATCHBOX) NOT(TEST)
| bucket span=h _time
| stats count(eval(process="start")) as total count(eval(process="end")) as error by _time app_name
| eval rate=round ((1-(error/total))*100,4)
| timechart span=h values(rate) as rate values(error) as error by app_name

On the Visualization tab, enable Trellis and split by app_name with an independent scale.

Select Column Chart and format the chart with error selected as the overlay field on a separate axis (View as Axis: On).

Splunk should display a series of column charts with success rate columns on the primary y-axis and an error count line on the secondary y-axis.

You can set Show Data Values to On in the chart configuration, but even with a large trellis size, the charts will be difficult to read. Unfortunately, core Splunk does not excel at labeling values in charts with many data points.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...