Splunk Search

How can I get an Ideal BurnDown line on a chart in Splunk?

kalyangoutham
New Member

I have a requirement to add an ideal Burndown line on a chart that shows a constant decrease in value of Y across a specified time interval.

To be more precise:
I want to get a BurnDown line in the period (Jan 1st to Jan 10th) and the initial StoryPoints (Y value) on Jan1st is 140.
The burndown points will be 140/10=14

Then the Timechart to be generated should be
Jan 1st -> 140
Jan 2nd -> 126 (140-14)
Jan 3rd->112 (140-(14*2))
Jan 4th->98 (140-14*3)
Jan 5th->84 (140-14*4).
.
.
.
Jan10th->0

How can we achieve this is Splunk? I will be glad to receive help on what functions we need to use or the combination of functions in Splunk. Thanks in advance.

0 Karma

sundareshr
Legend

Try this

| gentimes start=1/1/16 end=1/10/16 | eventstats first(starttime) as start last(starttime) as end | eval days=(end-start)/(60*60*24) | streamstats count | eval stories=round(140/count, 0) | stats values(stories) as stories by starttime | eval starttime=strftime(starttime, "%x %X")

kalyangoutham
New Member

Thanks Sundaresh. Able to get a straight line burndown chart with a minor modification of the above query. Thanks for sharing the logic on how this is to be calculated with the group of Splunk commands.

In place of eval stories=round(140/count, 0)
in the above command, i have used
eval stories=round(140-14*count, 0)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...