Splunk Search

Chart set range value

markgomez00
Explorer

Hi,

I have a perfmon counter which is monitoring the SLA, most of the time it's constant in a huge number(millions), and goes in a downward trend which basically indicates that the SLA is about to be breached.

what i want to achieve in the chart/panel is set a range within 0-100, so when the SLA goes down and reached the range <100 range that's the only time it should show in the chart, from 99 down to the lowest value it would reach

my search string is

host=[hostname] index=[index]  counter="SLA violation countdown"  | timechart max(Value) by instance

so far i have tried to add the options:

<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.maximumNumber">100</option>

but nothing shows up on the chart
also if you have better ideas on a better approach, it would be great 🙂
any help would be appreciated, Thanks in advance guys

Tags (3)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

For data to appear, the data's value must be within the chart's y-axis limits. If you set the y-axis to have a range of [0,100] then your data must also be [0,100] or it will be drawn "off the chart".

You could normalize your data, if you have an idea of what defines " < 100% ". Say for example anything below 123,456,789 is "abnormal" and we want a linear drop...

<your search> 
| eval sla_percent= if(count >= 123456789,101,((count / 123456789) * 100))

This establishes 123,456,789 widgets / time interval as "101% SLA". Anything above that is still 101% SLA. With the chart's y-axis fixed at [0,100] then the hard-coded 101% value will not be drawn on the chart at all. Anything less than your trigger value is ranged from 0 to 100 linearly. So if you are producing 122,000,000 widgets / time interval then that corresponds to an SLA of 98.82 -- and will appear on the chart.

Note if your chart is a bar or column chart instead of a line or area you may want to hard-code "ideal" at -1 instead of 101 -- so it's drawn "below" the lower range of the y-axis.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

For data to appear, the data's value must be within the chart's y-axis limits. If you set the y-axis to have a range of [0,100] then your data must also be [0,100] or it will be drawn "off the chart".

You could normalize your data, if you have an idea of what defines " < 100% ". Say for example anything below 123,456,789 is "abnormal" and we want a linear drop...

<your search> 
| eval sla_percent= if(count >= 123456789,101,((count / 123456789) * 100))

This establishes 123,456,789 widgets / time interval as "101% SLA". Anything above that is still 101% SLA. With the chart's y-axis fixed at [0,100] then the hard-coded 101% value will not be drawn on the chart at all. Anything less than your trigger value is ranged from 0 to 100 linearly. So if you are producing 122,000,000 widgets / time interval then that corresponds to an SLA of 98.82 -- and will appear on the chart.

Note if your chart is a bar or column chart instead of a line or area you may want to hard-code "ideal" at -1 instead of 101 -- so it's drawn "below" the lower range of the y-axis.

markgomez00
Explorer

Thanks @dwaddle, exactly what i needed :), had to set the normal SLA > 100, anything below that is abnormal and is show in the chart

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...