Splunk Search

How to create a timechart with overlay lines for Mean, Upper Control Limit, Lower Control Limit, and Targets?

DanielFordWA
Contributor

Hi,

I have a number of timecharts displaying KPIs over the last 30 days.

What would be the most efficient way to add in overlay lines with the Mean, Upper Control Limit, Lower Control Limit, and Targets?

The end result would be much like the below.

http://www.kaushik.net/avinash/excellent-analytics-tip-9-leverage-statistical-control-limits/

Does anyone have any examples?

Thanks,

Dan

1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

I think the simplest upper control / lower control limits are probably accomplished by using the perc##() percentile function of the timechart command.

sourcetype=access_combined
| timechart avg(bytes) as average, perc75(bytes) as upper_control_limit, perc25(bytes) as lower_control_limit

alt text

However, that is not really what you asked for. What you asked for more directly might look like this:

sourcetype=access_combined
| streamstats avg(bytes) as average, perc75(bytes) as upper_control_limit, perc25(bytes) as lower_control_limit
| table _time bytes average upper* lower*

alt text

Of course, you use use eval to set static thresholds as well.

sourcetype=access_combined
| eval upper = 3000
| eval lower = 1000
| streamstats avg(bytes) as average
| table _time bytes average upper lower

alt text
To go even further, directly as that article suggests - though note it isn't necessarily the only way to do this, would be something like this...

sourcetype=access_combined
| eventstats avg(bytes) as average, stdev(bytes) as stdev
| eval upper = average+(stdev*3)
| eval lower = average-(stdev*3)
| table _time bytes upper lower

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

I think the simplest upper control / lower control limits are probably accomplished by using the perc##() percentile function of the timechart command.

sourcetype=access_combined
| timechart avg(bytes) as average, perc75(bytes) as upper_control_limit, perc25(bytes) as lower_control_limit

alt text

However, that is not really what you asked for. What you asked for more directly might look like this:

sourcetype=access_combined
| streamstats avg(bytes) as average, perc75(bytes) as upper_control_limit, perc25(bytes) as lower_control_limit
| table _time bytes average upper* lower*

alt text

Of course, you use use eval to set static thresholds as well.

sourcetype=access_combined
| eval upper = 3000
| eval lower = 1000
| streamstats avg(bytes) as average
| table _time bytes average upper lower

alt text
To go even further, directly as that article suggests - though note it isn't necessarily the only way to do this, would be something like this...

sourcetype=access_combined
| eventstats avg(bytes) as average, stdev(bytes) as stdev
| eval upper = average+(stdev*3)
| eval lower = average-(stdev*3)
| table _time bytes upper lower

View solution in original post