Splunk Search

How to create a timechart with overlay lines for Mean, Upper Control Limit, Lower Control Limit, and Targets?

DanielFordWA
Contributor

Hi,

I have a number of timecharts displaying KPIs over the last 30 days.

What would be the most efficient way to add in overlay lines with the Mean, Upper Control Limit, Lower Control Limit, and Targets?

The end result would be much like the below.

http://www.kaushik.net/avinash/excellent-analytics-tip-9-leverage-statistical-control-limits/

Does anyone have any examples?

Thanks,

Dan

1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

I think the simplest upper control / lower control limits are probably accomplished by using the perc##() percentile function of the timechart command.

sourcetype=access_combined
| timechart avg(bytes) as average, perc75(bytes) as upper_control_limit, perc25(bytes) as lower_control_limit

alt text

However, that is not really what you asked for. What you asked for more directly might look like this:

sourcetype=access_combined
| streamstats avg(bytes) as average, perc75(bytes) as upper_control_limit, perc25(bytes) as lower_control_limit
| table _time bytes average upper* lower*

alt text

Of course, you use use eval to set static thresholds as well.

sourcetype=access_combined
| eval upper = 3000
| eval lower = 1000
| streamstats avg(bytes) as average
| table _time bytes average upper lower

alt text
To go even further, directly as that article suggests - though note it isn't necessarily the only way to do this, would be something like this...

sourcetype=access_combined
| eventstats avg(bytes) as average, stdev(bytes) as stdev
| eval upper = average+(stdev*3)
| eval lower = average-(stdev*3)
| table _time bytes upper lower

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

I think the simplest upper control / lower control limits are probably accomplished by using the perc##() percentile function of the timechart command.

sourcetype=access_combined
| timechart avg(bytes) as average, perc75(bytes) as upper_control_limit, perc25(bytes) as lower_control_limit

alt text

However, that is not really what you asked for. What you asked for more directly might look like this:

sourcetype=access_combined
| streamstats avg(bytes) as average, perc75(bytes) as upper_control_limit, perc25(bytes) as lower_control_limit
| table _time bytes average upper* lower*

alt text

Of course, you use use eval to set static thresholds as well.

sourcetype=access_combined
| eval upper = 3000
| eval lower = 1000
| streamstats avg(bytes) as average
| table _time bytes average upper lower

alt text
To go even further, directly as that article suggests - though note it isn't necessarily the only way to do this, would be something like this...

sourcetype=access_combined
| eventstats avg(bytes) as average, stdev(bytes) as stdev
| eval upper = average+(stdev*3)
| eval lower = average-(stdev*3)
| table _time bytes upper lower
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...