Hi everyone,
I have continuous data from a leakage test station with values as low as 1e-8 and spikes up to 1e-2 mbar*l/s (in the image its way higher but this is very rare).
Is there a way to display them over this span correctly in a standard timechart?
I already tried to set min or max for y axis and converted the y axis to logarithmic.
The logarithmic scale seems to display only 1, 0.1, 0.01 and not smaller or at least gives the smaller numbers not enough 'room' to display (from 1 to 0.1 is 90% of the timechart area, from 0.1 to 0.01 is 8% and for the smaller values just 2 % of the area).
A other diagram with js or something is not possible for me at the moment.
Thanks!!
Here's an example with data from 0-1. Here the "log-scale" chart is actually just a linear scale chart with gridlines for powers of 10, same as the original post. Small data is compressed at the bottom of the chart
| makeresults count=4
| streamstats count
| rename count as i
| eval value=pow(10,-i), logValue=log(value)
| chart avg(value) by i
sample search:
| makeresults count=10
| streamstats count
| rename count as i
| eval i=i-4, value=pow(10,i), logValue=log(value)
| chart avg(value) by i
when charted log scale, this data should display as a straight line, and does for values from 10-1000000 (1e1-1e6). However, splunk does not create divisions for 0.1-1, 0.01-0.01, 0.001-0.01, etc., so the values <10 are incorrectly compressed on the chart
I had trouble with this as well. Log scale charts in splunk appear to be broken for non-positive powers of 10:
My workaround is to chart log(value) on a linear scale, but this is not easy to consume for most folks.
In the image there is no "0" value. They are actually something like 1e-8