Splunk Search

How can I get an Ideal BurnDown line on a chart in Splunk?

kalyangoutham
New Member

I have a requirement to add an ideal Burndown line on a chart that shows a constant decrease in value of Y across a specified time interval.

To be more precise:
I want to get a BurnDown line in the period (Jan 1st to Jan 10th) and the initial StoryPoints (Y value) on Jan1st is 140.
The burndown points will be 140/10=14

Then the Timechart to be generated should be
Jan 1st -> 140
Jan 2nd -> 126 (140-14)
Jan 3rd->112 (140-(14*2))
Jan 4th->98 (140-14*3)
Jan 5th->84 (140-14*4).
.
.
.
Jan10th->0

How can we achieve this is Splunk? I will be glad to receive help on what functions we need to use or the combination of functions in Splunk. Thanks in advance.

0 Karma

sundareshr
Legend

Try this

| gentimes start=1/1/16 end=1/10/16 | eventstats first(starttime) as start last(starttime) as end | eval days=(end-start)/(60*60*24) | streamstats count | eval stories=round(140/count, 0) | stats values(stories) as stories by starttime | eval starttime=strftime(starttime, "%x %X")

kalyangoutham
New Member

Thanks Sundaresh. Able to get a straight line burndown chart with a minor modification of the above query. Thanks for sharing the logic on how this is to be calculated with the group of Splunk commands.

In place of eval stories=round(140/count, 0)
in the above command, i have used
eval stories=round(140-14*count, 0)

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...