Splunk Search

How to set different charts' Y axis values to be dependent of the values of one chart ?

juancarlos_pola
Explorer

Hello. This is my third of fourth question in this page (I think) so I would like to beg you mercy if this issue/questions has been already dealt with.
Basically, I have 3 charts with different Y-Axis values (let's say data load in MB). The 1st is the highest load and has a max Y-axis value of around 25. The 2nd chart has low load and it's limit in Y-axis is around 0.5. The third one is around 2.5. When I compare the three charts, the line is drawn at the same level.
But what I really want is for the 3 of them to have the same Y-axis limits as the top one. Needless to say, if the Y-axis value of the top limit chart increases or decreases, all of them would change as well automatically.

I have found out that I can set manually the Y-axis min and max value but this is only temporarily. Sooner I will input more charts on the page and the limits may go as high as 200 or more. So when this happens, I would like all the charts to have the same limit as the maximum one.

Thank you for your time and your help in advance. I really hope I could find some help here.
Best,
Juan

GaryZ
Path Finder

I'm looking for an answer for this question as well.  Has anyone gotten an answer for this?   I tried the suggestion from @chahal3108.. But I haven't been able to get the resolution I wanted.  

 

I am able to get the maximum value in the dropdown input.  However the charts does not seem to update with the new maximum.    I've also tried creating a couple static values in the dropdown, and selecting the values after the searches are done.  But I didn't see any changes to the chart, when I change the input value.  

 

I do see changes to the chart, when I hardcode the values in the <option>.  Curious if anyone was able to come with a solution.  

 

Thanks,

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use the done handler of the panel search to set some tokens and use the tokens in the charting options

          <query>
...
| eval _minimum=``` Calculate minimum for scale (use "hidden" field name beginning with "_") ```
| eval _maximum=``` Calculate maximum for scale (use "hidden" field name beginning with "_") ```
...
          </query>
          <done>
            <set token="chartmin">$result._minimum$</set>
            <set token="chartmax">$result._maximum$</set>
          </done>
        </search>
...
        <option name="charting.axisY.maximumNumber">$chartmax$</option>
        <option name="charting.axisY.minimumNumber">$chartmin$</option>
0 Karma

GaryZ
Path Finder

@ITWhisperer 

 

Is this my correct understanding on how to implement this?

 

There are a few areas I'm not too sure about. 

1) Would I need to reference to the searchID in the chart/panel tags?

2) Should I place the query inside the row/panel tag?

 

 

<form>
	<search id="get_max" base=“main_search">
		<query>
			| eventstats max(duration) as _max_duration
		</query>
		<done>
			<set token=“chartmax”> $result._max_duration$ </set>
		</done>


	</search>
…

<fieldset>
...
</fieldset>


<row>

	<panel>
		<chart>
		…
		<option name=“charting.axisY.maximumNumber”>$chartmax$</option> 
		</chart>
	</panel>
	<panel>
		<chart>
		…
		<option name=“charting.axisY.maximumNumber”>$chartmax$</option> 
		</chart>
	</panel>

</row>
...

</form>

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like this should work (assuming main_search is also defined and the panels reference either main_search or get_max) - They may need to reference get_max to ensure it executes (I am not 100% on that)

You might also want to add an init block to initialise chartmax to an arbitrary value

<form>
  <init>
    <set token="chartmax">100</set>
  </init>
...
0 Karma

chahal3108
Explorer

Hi,

You can achieve this. First, create a hidden dropdown with dynamic options. Pass your query to calculate the maximum y-axis range from this. Now the dropdown token will have that max value. Then use that token, say max_count, as folows:

<option name="charting.axisY.maximumNumber">$max_count$</option>

So, the code will look like this (intentionally removed other options for better visibility):

<fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="max_count" searchWhenChanged="true" depends="$xyz$"> //any non-existing token for depends
      <label>Count</label>
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch earliest="0" latest="" fieldForLabel="Count" fieldForValue="Count">query</populatingSearch>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Title</title>
        <searchString>query</searchString>
        <earliestTime>$InputTime.earliest$</earliestTime>
        <latestTime>$InputTime.latest$</latestTime>
        <option name="charting.axisY.maximumNumber">$max_count$</option>
        <option name="charting.chart">column</option>
      </chart>
    </panel>
  </row>

Hope this helps !!!!

PS: Tested on Splunk 6.2+. For versions less than 6.2, hidden dropdown functionality won't work.

0 Karma

woodcock
Esteemed Legend

I do not know of any way to do what you are asking (that is not the same thing as "there is not a way") but I think if you change your Y-axis scales from linear to log, you will be very pleased with that option as a work-around for what is really bothering you which, if I am not mistaken, is that you have one line that is up high and easily readable which compresses all the other lines and squishes them down on top of eachother at the bottom such that you cannot see the detail of their "wiggles". In this way, you can set the Max value to a value that is the nearest order of magnitude of the biggest value that you expect across all of your charts and each will still look very readable even when the values are small.

0 Karma

cspires64
Path Finder

No, changing the y-axis from linear to log does not solve the issue. The problem is: the customer wants the same scale on two charts so he can compare the results. Hard-coding the min, max values is not an option. Scale varies wildly from week to week i.e. 80k max one week, 400 max the next week. The scale needs to dynamically change based on the max value from both charts.

0 Karma

cspires64
Path Finder

I am looking for the answer to this question as well. Have you had any luck?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...