pie chart sparkline to see filling ratio of splunk mount_points

[SierraX]

Hi,
I work with some searchhead/indexing clusters with some machines and some mounts, in a growing environment.
Now I try to create an overview to see how full the Splunk relevant partitions are. A nice way to have an human readable overview is a 2 field Pie Chart.
But there are 36 partitions at the moment and with every enterprise instance 1 or to partitions added.
Best way I think is to do it in a sparkline with pie format
The search I use to get the requiered data is:

index=_introspection sourcetype=splunk_disk_objects component=Partitions

| dedup host data.mount_point
| table host data.mount_point data.fs_type data.capacity data.available
| convert auto(data.capacity) auto(data.available)
| rename data.* as *

Try to create pie sparklines since hours but doesn't work.

Is it possible to create pie chart sparklines like that in splunk?
And when yes, how?

Thanks in advance

And Kind Regards
SierraX

[niketn]

@SierraX... I referred to http://omnipotent.net/jquery.sparkline/#s-about and all the Sparkline types are built in to Splunk (I tested in Splunk 6.6, however expect the same to be available in all older 6.x versions of Splunk Enterprise. Sparkline formatting works for bar, line, pie, tristate, bullet, discrete, box.

You can show pie using format option for sparkline with type as pie

        <!-- change type to bar, line, pie, tristate, bullet, discrete, box-->
        <format type="sparkline" field="trend">
            <option name="type">pie</option>
        </format>

Following is a run anywhere example modified from Splunk 6.x Dashboard Examples App to show pie sparkline.

    <table>
        <title>Basic Sparkline Bar w/ Style Options</title>
        <!-- Set span for each sparkline datapoint to be 1 hour -->
        <search>
            <query>index=_internal | chart count sparkline(count, 1h) as trend by sourcetype | sort -count</query>
            <earliest>-24h@h</earliest>
            <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
        <!-- Set sparkline options here; make sure that field matches field name of the search results -->
        <!-- change type to bar, line, pie, tristate, bullet, discrete, box-->
        <format type="sparkline" field="trend">
            <option name="type">pie</option>
        </format>
    </table>

I will request to include this information in Splunk documentation, Splunk Dev and Splunk 6.x Dashboard Examples App.

[niketn]

Look at Radar Chart custom visualization example

http://dev.splunk.com/view/webframework-tutorials/SP-CAAAERK

[SierraX]

Seems not what I'm looking for.

Searching for something like this:

But with a Pie Chart instead of a range map symbol.

[niketn]

I know of sparklines and icons within table but not pie chart. With Splunk 6.5 you can conditionally format including color column based on range value. (For example 10.2% above can be green and 97% will be red if it represents available space). With previous versions of Splunk you could use Inline icon like you have shown and inline icon with value 10% next to it (Refer to Splunk 6.x Dashboard examples).

Also explore custom visualization Horizon Chart which can show overlaid stats from various server over time.

If none of the above suits your needs, can you provide a mock up of what you want? Or if possible some screenshot from another app/visualization on net which does this?

[SierraX]

The custom visualization Horizon Chart looks interesting... I will checkout.

The question about "as sparkline" was about the pie examples on omnipotent
(Think this was also referred by splunk.)

I'm thankful for you suggestions.
I only expect a "yes or no" answer maybe with a "in future versions"