Monitoring Splunk

How we can create a line chart with the area between max and min value filled with color ?

Real_captain
Path Finder

HI 
I want to know if it is possible to have a line chart with the area between max and min value filled with color. 

Example : 
For the below chart , we will be having 2 more new lines ( Max and Min) and we would like to have color filed in the area between Max and Min lines. 

Real_captain_0-1729151544873.png

Current Query to generate the 3 lines : 
| table Start_Time CurrentWeek "CurrentWeek-1" "CurrentWeek-2" 

2 more lines ( Max and Min ) needs to be added in the above linechart and fill the color between max and min. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

| eventstats min(CurrentWeek) as lower max(CurrentWeek) as upper min(CurrentWeek-1) as lower1 max(CurrentWeek-1) as upper1 min(CurrentWeek-2) as lower2 max(CurrentWeek-2) as upper2
| eval lower=min(lower, lower1, lower2), upper=max(upper, upper1, upper2)
| fields - lower1 upper1 lower2 upper2
| eval _lowerrate="lower", _upperrate="upper", _predictedrate="CurrentWeek"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Real_captain ,

you could try using the area charts and eventually using white for the min area so it seems that it's coloured only the difference between min and max.

Ciao.

Giuseppe

0 Karma

Real_captain
Path Finder

Hi @gcusello  
How can we select white for the min area in area chart. 

Which option to select ?? 

Real_captain_0-1729523266661.png

 

Real_captain_1-1729523343224.png

 

 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Real_captain ,

these are the options to define colours of the areas:

<option name="charting.legend.labels">[YES,NO,UND]</option>
<option name="charting.seriesColors">[0xff3f31,0x0dc681,0xe1dfdf]</option>

you have to insert the values in the first option and the colours in the second one.

Ciao.

Giuseppe

0 Karma

dural_yyz
Builder

I would suggested a stacked bar chart and leave min/max/curr/curr-1/curr-2 as chart overlays but I don't know if that would solve your problem.

Stack the below-min(white) / between_max_min(shaded) / above-min(white).  Calculate the above min as some percentage above overall max value ie. overall_max=max(all_numbers)x1.25

It's the only way I can think to get the below min value as white - but I think that also violates some of the other things you were asking for.

0 Karma
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...