Monitoring Splunk

How we can create a line chart with the area between max and min value filled with color ?

Real_captain
Path Finder

HI 
I want to know if it is possible to have a line chart with the area between max and min value filled with color. 

Example : 
For the below chart , we will be having 2 more new lines ( Max and Min) and we would like to have color filed in the area between Max and Min lines. 

Real_captain_0-1729151544873.png

Current Query to generate the 3 lines : 
| table Start_Time CurrentWeek "CurrentWeek-1" "CurrentWeek-2" 

2 more lines ( Max and Min ) needs to be added in the above linechart and fill the color between max and min. 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this

| eventstats min(CurrentWeek) as lower max(CurrentWeek) as upper min(CurrentWeek-1) as lower1 max(CurrentWeek-1) as upper1 min(CurrentWeek-2) as lower2 max(CurrentWeek-2) as upper2
| eval lower=min(lower, lower1, lower2), upper=max(upper, upper1, upper2)
| fields - lower1 upper1 lower2 upper2
| eval _lowerrate="lower", _upperrate="upper", _predictedrate="CurrentWeek"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Real_captain ,

you could try using the area charts and eventually using white for the min area so it seems that it's coloured only the difference between min and max.

Ciao.

Giuseppe

0 Karma

Real_captain
Path Finder

Hi @gcusello  
How can we select white for the min area in area chart. 

Which option to select ?? 

Real_captain_0-1729523266661.png

 

Real_captain_1-1729523343224.png

 

 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Real_captain ,

these are the options to define colours of the areas:

<option name="charting.legend.labels">[YES,NO,UND]</option>
<option name="charting.seriesColors">[0xff3f31,0x0dc681,0xe1dfdf]</option>

you have to insert the values in the first option and the colours in the second one.

Ciao.

Giuseppe

0 Karma

dural_yyz
Motivator

I would suggested a stacked bar chart and leave min/max/curr/curr-1/curr-2 as chart overlays but I don't know if that would solve your problem.

Stack the below-min(white) / between_max_min(shaded) / above-min(white).  Calculate the above min as some percentage above overall max value ie. overall_max=max(all_numbers)x1.25

It's the only way I can think to get the below min value as white - but I think that also violates some of the other things you were asking for.

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...