Dashboards & Visualizations

dynamic span

wcleong
New Member

hi, I have a area chart as below search command

index=index_rv TAG="*" CELL_NAME=* TAG!=TAG CELL_NAME!=CELL_NAME |  eval Diff_Percentage = max(Metal_I_diff)  | eval Current = Metal_I_1 * 1 |  chart min(Diff_Percentage),max(Diff_Percentage) by Current span=0.01

however, my data range for x axis might be varied, and I would like to have the spanning to be max(Current)/1000 so that I can span it to 1000 plot only, can I know how to do it? I tried below but it is not working

index=index_rv TAG="*" CELL_NAME=* TAG!=TAG CELL_NAME!=CELL_NAME |  eval Diff_Percentage = max(Metal_I_diff)  | eval Current = Metal_I_1 * 1 |  chart min(Diff_Percentage),max(Diff_Percentage) by Current span=eval(max (Current)/10000)
Tags (2)
0 Karma

wcleong
New Member

The problem is when using bins, it will tend to not bucketise the 0 value, and cause the graph to be non linear on the x-axis.. I need to see the overall graph shape.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

You might try instead of setting a specific span= to use bins= in order to tell the chart command that you want it to use (up to) a set number of bins, and let it figure out an appropriate size.

0 Karma

wcleong
New Member

The problem is when using bins, it will tend to not bucketise the 0 value, and cause the graph to be non linear on the x-axis.. I need to see the overall graph shape.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...