Dashboards & Visualizations

pie chart sparkline to see filling ratio of splunk mount_points

SierraX
Communicator

Hi,
I work with some searchhead/indexing clusters with some machines and some mounts, in a growing environment.
Now I try to create an overview to see how full the Splunk relevant partitions are. A nice way to have an human readable overview is a 2 field Pie Chart.
But there are 36 partitions at the moment and with every enterprise instance 1 or to partitions added.
Best way I think is to do it in a sparkline with pie format
The search I use to get the requiered data is:

index=_introspection sourcetype=splunk_disk_objects component=Partitions

| dedup host data.mount_point
| table host data.mount_point data.fs_type data.capacity data.available
| convert auto(data.capacity) auto(data.available)
| rename data.* as *

Try to create pie sparklines since hours but doesn't work.

Is it possible to create pie chart sparklines like that in splunk?
And when yes, how?

Thanks in advance

And Kind Regards
SierraX

0 Karma

niketn
Legend

@SierraX... I referred to http://omnipotent.net/jquery.sparkline/#s-about and all the Sparkline types are built in to Splunk (I tested in Splunk 6.6, however expect the same to be available in all older 6.x versions of Splunk Enterprise. Sparkline formatting works for bar, line, pie, tristate, bullet, discrete, box.

You can show pie using format option for sparkline with type as pie

        <!-- change type to bar, line, pie, tristate, bullet, discrete, box-->
        <format type="sparkline" field="trend">
            <option name="type">pie</option>
        </format>

Following is a run anywhere example modified from Splunk 6.x Dashboard Examples App to show pie sparkline.

    <table>
        <title>Basic Sparkline Bar w/ Style Options</title>
        <!-- Set span for each sparkline datapoint to be 1 hour -->
        <search>
            <query>index=_internal | chart count sparkline(count, 1h) as trend by sourcetype | sort -count</query>
            <earliest>-24h@h</earliest>
            <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
        <!-- Set sparkline options here; make sure that field matches field name of the search results -->
        <!-- change type to bar, line, pie, tristate, bullet, discrete, box-->
        <format type="sparkline" field="trend">
            <option name="type">pie</option>
        </format>
    </table>

I will request to include this information in Splunk documentation, Splunk Dev and Splunk 6.x Dashboard Examples App.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

Look at Radar Chart custom visualization example

http://dev.splunk.com/view/webframework-tutorials/SP-CAAAERK

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SierraX
Communicator

Seems not what I'm looking for.

Searching for something like this:

alt text

But with a Pie Chart instead of a range map symbol.

0 Karma

niketn
Legend

I know of sparklines and icons within table but not pie chart. With Splunk 6.5 you can conditionally format including color column based on range value. (For example 10.2% above can be green and 97% will be red if it represents available space). With previous versions of Splunk you could use Inline icon like you have shown and inline icon with value 10% next to it (Refer to Splunk 6.x Dashboard examples).

Also explore custom visualization Horizon Chart which can show overlaid stats from various server over time.

If none of the above suits your needs, can you provide a mock up of what you want? Or if possible some screenshot from another app/visualization on net which does this?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

SierraX
Communicator

The custom visualization Horizon Chart looks interesting... I will checkout.

The question about "as sparkline" was about the pie examples on omnipotent
(Think this was also referred by splunk.)

I'm thankful for you suggestions.
I only expect a "yes or no" answer maybe with a "in future versions"

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...