generating a graphic in dashboard xml code

[riley_lewis]

Hi,

I am trying to do a chart overlay using a normal distribution graphic based upon the mean and standard deviation acquired from the fieldsummary command. I can generate the values in perl (below) for a bell curve. Can you tell me how to do this in the Splunk Dashboard xml? Thanks.

#!/usr/bin/perl

# min, max, count, mean, stdev all come from the fieldsummary command.

$min = 0.442;
$max = 0.507;
$mean = 0.4835625;
$stdev = 0.014440074377630105;
$count = 128;
$pi = 3.141592653589793238462;

# The numbers above do not indicate a Gaussian distribution.
# Create an artificial normal distribution (for the plot overlay)
# based on 6-sigma.

$min = sprintf("%.3f", $mean - 3.0*$stdev);       # use sprintf as a rounding function
$max = sprintf("%.3f", $mean + 3.0*$stdev);

$interval = ($max - $min)/($count - 1);
$x = $min;
for ($i=0; $i<$count; $i++)
  {
   $y = (1.0/($stdev*sqrt(2.0*$pi))) * exp(-0.5*((($x-$mean)/$stdev)**2));
   $myFIELD[$i] = sprintf(%.3f",$y);
   printf("myFIELD[$i]\n");
   $x = $x + $interval;
  }

exit;

[bowesmana]

Quite literally

| makeresults 
| fields - _time
| eval min = 0.442
| eval max = 0.507
| eval mean = 0.4835625
| eval stdev = 0.014440074377630105
| eval count = 128
| eval pi = 3.141592653589793238462
| eval min = printf("%.3f", mean - 3.0 *stdev)```;       # use sprintf as a rounding function```
| eval max = printf("%.3f", mean + 3.0 * stdev)
| eval x=min
| eval interval = (max - min)/(count - 1)
| eval c=mvrange(0, count, 1)
| foreach c mode=multivalue [ | eval y= (1.0/(stdev * sqrt(2.0 * pi))) * exp(-0.5*(pow(((x - mean) / stdev), 2))), myFIELD=mvappend(myFIELD, printf("%.3d", y)), x = x + interval ]
| fields - c

[bowesmana]

And if you then want to make that a bar chart, replace the fields - c at the end with

| fields myFIELD
| mvexpand myFIELD
| eval count=tonumber(myFIELD)

bowesmana_0-1713925545827.png