Splunk Search

Could I draw timechart with prediction line without "predict" command ?

leo_wang
Path Finder

Hi,
As. title.
I know I could use "predict" command to predict the value of my data.
But I have some data which are coming from "R" script, and already have prediction value in it.

How could I draw the timechart digram with prediction line by timechart command for those data ?
( attached picture for example )

alt text

0 Karma
1 Solution

niketn
Legend

In Splunk you can get close to above visualization using Chart Overlays and charting.lineDashStyle . However, for applying Dash line style you will have to change the graph to Area or Column (not line chart or your main field will also pick the same style)

Step 1
If you have got the three fields (field1, field2, field3) to plot the series, you can feed them to timechart for example

 <your base search>
| timechart sum(field1) as PredictField sum(field2) as Upper95 sum(field3) as Lower95

(Above is just an example, you should use field names and statistical command according to your need.)

Step 2
You then edit the Chart and change Upper95 and Lower95 fields as overlayFields by editing Chart Panel or through Simple XML

 <option name="charting.chart.overlayFields">Upper95,Lower95</option>

Step 3
Finally, add the charting.lineDashstyle option in Simple XML by editing the source.

  <option name="charting.lineDashStyle">shortDash</option>

Refer to Charting reference for lineDashStyle property: http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

In Splunk you can get close to above visualization using Chart Overlays and charting.lineDashStyle . However, for applying Dash line style you will have to change the graph to Area or Column (not line chart or your main field will also pick the same style)

Step 1
If you have got the three fields (field1, field2, field3) to plot the series, you can feed them to timechart for example

 <your base search>
| timechart sum(field1) as PredictField sum(field2) as Upper95 sum(field3) as Lower95

(Above is just an example, you should use field names and statistical command according to your need.)

Step 2
You then edit the Chart and change Upper95 and Lower95 fields as overlayFields by editing Chart Panel or through Simple XML

 <option name="charting.chart.overlayFields">Upper95,Lower95</option>

Step 3
Finally, add the charting.lineDashstyle option in Simple XML by editing the source.

  <option name="charting.lineDashStyle">shortDash</option>

Refer to Charting reference for lineDashStyle property: http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...