Monitoring Splunk

How we can create a line chart with the area between max and min value filled with color ?

Real_captain
Path Finder

HI 
I want to know if it is possible to have a line chart with the area between max and min value filled with color. 

Example : 
For the below chart , we will be having 2 more new lines ( Max and Min) and we would like to have color filed in the area between Max and Min lines. 

Real_captain_0-1729151544873.png

Current Query to generate the 3 lines : 
| table Start_Time CurrentWeek "CurrentWeek-1" "CurrentWeek-2" 

2 more lines ( Max and Min ) needs to be added in the above linechart and fill the color between max and min. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

| eventstats min(CurrentWeek) as lower max(CurrentWeek) as upper min(CurrentWeek-1) as lower1 max(CurrentWeek-1) as upper1 min(CurrentWeek-2) as lower2 max(CurrentWeek-2) as upper2
| eval lower=min(lower, lower1, lower2), upper=max(upper, upper1, upper2)
| fields - lower1 upper1 lower2 upper2
| eval _lowerrate="lower", _upperrate="upper", _predictedrate="CurrentWeek"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Real_captain ,

you could try using the area charts and eventually using white for the min area so it seems that it's coloured only the difference between min and max.

Ciao.

Giuseppe

0 Karma

Real_captain
Path Finder

Hi @gcusello  
How can we select white for the min area in area chart. 

Which option to select ?? 

Real_captain_0-1729523266661.png

 

Real_captain_1-1729523343224.png

 

 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Real_captain ,

these are the options to define colours of the areas:

<option name="charting.legend.labels">[YES,NO,UND]</option>
<option name="charting.seriesColors">[0xff3f31,0x0dc681,0xe1dfdf]</option>

you have to insert the values in the first option and the colours in the second one.

Ciao.

Giuseppe

0 Karma

dural_yyz
Builder

I would suggested a stacked bar chart and leave min/max/curr/curr-1/curr-2 as chart overlays but I don't know if that would solve your problem.

Stack the below-min(white) / between_max_min(shaded) / above-min(white).  Calculate the above min as some percentage above overall max value ie. overall_max=max(all_numbers)x1.25

It's the only way I can think to get the below min value as white - but I think that also violates some of the other things you were asking for.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...