Monitoring Splunk

How we can create a line chart with the area between max and min value filled with color ?

Real_captain
Path Finder

HI 
I want to know if it is possible to have a line chart with the area between max and min value filled with color. 

Example : 
For the below chart , we will be having 2 more new lines ( Max and Min) and we would like to have color filed in the area between Max and Min lines. 

Real_captain_0-1729151544873.png

Current Query to generate the 3 lines : 
| table Start_Time CurrentWeek "CurrentWeek-1" "CurrentWeek-2" 

2 more lines ( Max and Min ) needs to be added in the above linechart and fill the color between max and min. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

| eventstats min(CurrentWeek) as lower max(CurrentWeek) as upper min(CurrentWeek-1) as lower1 max(CurrentWeek-1) as upper1 min(CurrentWeek-2) as lower2 max(CurrentWeek-2) as upper2
| eval lower=min(lower, lower1, lower2), upper=max(upper, upper1, upper2)
| fields - lower1 upper1 lower2 upper2
| eval _lowerrate="lower", _upperrate="upper", _predictedrate="CurrentWeek"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Real_captain ,

you could try using the area charts and eventually using white for the min area so it seems that it's coloured only the difference between min and max.

Ciao.

Giuseppe

0 Karma

Real_captain
Path Finder

Hi @gcusello  
How can we select white for the min area in area chart. 

Which option to select ?? 

Real_captain_0-1729523266661.png

 

Real_captain_1-1729523343224.png

 

 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Real_captain ,

these are the options to define colours of the areas:

<option name="charting.legend.labels">[YES,NO,UND]</option>
<option name="charting.seriesColors">[0xff3f31,0x0dc681,0xe1dfdf]</option>

you have to insert the values in the first option and the colours in the second one.

Ciao.

Giuseppe

0 Karma

dural_yyz
Builder

I would suggested a stacked bar chart and leave min/max/curr/curr-1/curr-2 as chart overlays but I don't know if that would solve your problem.

Stack the below-min(white) / between_max_min(shaded) / above-min(white).  Calculate the above min as some percentage above overall max value ie. overall_max=max(all_numbers)x1.25

It's the only way I can think to get the below min value as white - but I think that also violates some of the other things you were asking for.

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...