Splunk Search

How can I get an Ideal BurnDown line on a chart in Splunk?

kalyangoutham
New Member

I have a requirement to add an ideal Burndown line on a chart that shows a constant decrease in value of Y across a specified time interval.

To be more precise:
I want to get a BurnDown line in the period (Jan 1st to Jan 10th) and the initial StoryPoints (Y value) on Jan1st is 140.
The burndown points will be 140/10=14

Then the Timechart to be generated should be
Jan 1st -> 140
Jan 2nd -> 126 (140-14)
Jan 3rd->112 (140-(14*2))
Jan 4th->98 (140-14*3)
Jan 5th->84 (140-14*4).
.
.
.
Jan10th->0

How can we achieve this is Splunk? I will be glad to receive help on what functions we need to use or the combination of functions in Splunk. Thanks in advance.

0 Karma

sundareshr
Legend

Try this

| gentimes start=1/1/16 end=1/10/16 | eventstats first(starttime) as start last(starttime) as end | eval days=(end-start)/(60*60*24) | streamstats count | eval stories=round(140/count, 0) | stats values(stories) as stories by starttime | eval starttime=strftime(starttime, "%x %X")

kalyangoutham
New Member

Thanks Sundaresh. Able to get a straight line burndown chart with a minor modification of the above query. Thanks for sharing the logic on how this is to be calculated with the group of Splunk commands.

In place of eval stories=round(140/count, 0)
in the above command, i have used
eval stories=round(140-14*count, 0)

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...