Splunk Search

How can I customize my chart to show labels instead of number values and to be color-coded?

duffeysplunk
Path Finder

I have a service which we need to monitor discrete states. I only get events if the state changes. I can map these states (e.g. error, init, pending, standby, hot) to numerical values and then graph them on a timechart. With the filldown command I can also maintain the current state to produce a graph that shows the current state at any given time.

What I would like to do next is map those numerical values and provide some content. Ideally it would be to replace the y-axis so that instead of -1 through 3 it would display the states as text. Other options that would also work would be to color each column a different color based on the state (for example, make the column chart turn red when it is in an error state), or provide a legend that would make it easier to read. Basically I want someone to be able to look at the timechart and say at a given time what the state was without wondering what a 0, 1, 2 or 3 means.

This is what I have thus far:
alt text

Also, if it gets me the desired effect I could also break it down so RCS, Realtime, and isps do not appear on the same panel but ideally would like to have that functionality as well.

Any ideas that might help on this.

Splunk 6.6.1

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Run anywhere sample that produces something like you are asking for...

| makeresults 
| eval status="error init hot pending standby whatever"
| makemv status 
| mvexpand status
| streamstats count as recno
| eval _time=60*floor(_time/60) + 60*recno
| eval mycount = 10 
| table _time mycount status
| eval range= case(status="error","red", status="init","purple", status="hot","green", status="pending","gray", status="standby","blue", true(),"black")
| chart sum(mycount) as count by _time status

The height of the bar could be manipulated however you want it.

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Run anywhere sample that produces something like you are asking for...

| makeresults 
| eval status="error init hot pending standby whatever"
| makemv status 
| mvexpand status
| streamstats count as recno
| eval _time=60*floor(_time/60) + 60*recno
| eval mycount = 10 
| table _time mycount status
| eval range= case(status="error","red", status="init","purple", status="hot","green", status="pending","gray", status="standby","blue", true(),"black")
| chart sum(mycount) as count by _time status

The height of the bar could be manipulated however you want it.

View solution in original post

0 Karma

duffeysplunk
Path Finder

I was able to use something very close to this, but also had to use multiseries to get it display exactly how I wanted. Thanks

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!