About darkins

darkins

ok i think i have the formula worked out and now i can get my average and totals on one chart. i suspect, however, that you cant overlay a line chart on a stacked column chart as now that i am able to add my average to my stacked column, it appears, but appears as one of the stacked items in each column and not as a line as a line overlay (the large orange stacked counts are the average)

darkins

HaltedCyclesPerDayMA is computed in the eval line above as shown the query gives me a stacked column chart (stacked by cycle), i want the HaltedCyclesPerDayMA as a line overlay (showing the moving average on top of the raw data

darkins

i have this on other panels but cant get it on a stacked column chart | streamstats current=f last(Timestamp) as HaltedCycleLastTime by Cycle | eval HaltedCycleSecondsHalted=round(HaltedCycleLastTime - Timestamp,0) | eval HaltedCycleSecondsHalted=if(HaltedCycleSecondsHalted < 20,HaltedCycleSecondsHalted,0) | streamstats time_window=30d sum(HaltedCycleSecondsHalted) as HaltedCycleSecondsPerDayMA | eval HaltedCycleSecondsPerDayMA=round(HaltedCycleSecondsPerDayMA,0) | chart sum(HaltedCycleSecondsHalted) as HaltedSecondsPerDayPerCycle by CycleDate Cycle limit=0 this produces a stacked column based on the chart command , but in dashboard studio i expect to see HaltedCycleSecondsPerDayMA as a pickable field and i dont. I added to code as overlayfields but still not showing.

darkins

i have created a stacked bar based on a data source (query) and everything works with the exception of: i have to select each data value to display when the query runs through Data Configuration - Y meaning all of my desired values show up there but they are not "selected" by default so the chart is blank until i select them?

darkins

ok this should work but one wrinkle, i want to do this on two fields meaning: these are my records Job1 10/4/2024 20241004 10/4/2024 0:38:27 Job1 10/4/2024 20241004 10/4/2024 0:38:41 Job 2 10/4/2024 20241004 10/4/2024 17:39:12 Job 2 10/4/2024 20241004 10/4/2024 17:39:24 Job 2 10/4/2024 20241004 10/4/2024 17:39:34 Job1 10/5/2024 20241004 10/4/2024 0:38:27 Job1 10/5/2024 20241004 10/4/2024 0:38:35 from this i want to be able to say: job1 took 14 seconds on 10/4/2024 and job 2 took 22 seconds on 10/4 job 1 took 8 seconds on 10/5

darkins

My query returns these events, i need to compute the total time A was in this state and total time B was in this state. My thought is to subtract the TImestamp of the first A from the most recent A and so on for B but cant figure out the right way to do this? Timestamp Job Date LoggedTime Ready 1728092168.000000 A 10/4/2024 21:36:03 1 1728092163.000000 A 10/4/2024 21:35:50 1 1728092150.000000 A 10/4/2024 21:35:27 1 1728092127.000000 A 10/4/2024 21:35:16 1 1728090335.000000 B 10/4/2024 21:05:15 2 1728090315.000000 B 10/4/2024 21:05:03 2 1728090303.000000 B 10/4/2024 21:04:53 2 1728090293.000000 B 10/4/2024 21:04:31 2

darkins

WINNER WINNER! Thank you very much!

darkins

not sure i can do that using a base query and then a chained query panel a gives me MA line | timechart count span=1d | streamstats time_window=30d avg(count) as A | eval A=round(A,0) Panel B gives me count by day bar | timechart span=1d count(B) by B

darkins

Using dashboard studio i have my data source for one panel then a chained datasource for another panel. The first panel is a barchart of counts by day, the second is a moving average. Trying to overlay the moving average on top of the barchart. Have done this in classic using overlays, but in studio dont know how to reference the chained datasource results in the first panel. For example my bar chart visualization code looks like this. In overlay fields i tried to explicitly reference the data source name but doesnt seem to work. i know both queries/data sources are working as my base search works and my chained search works when show in separate panels. { "type": "splunk.column", "dataSources": { "primary": "ds_C2wKdHsA" }, "title": "Per Day Count", "options": { "y": "> primary | frameBySeriesNames('NULL','_span','_spandays')", "legendTruncation": "ellipsisOff", "legendDisplay": "off", "xAxisTitleVisibility": "hide", "xAxisLabelRotation": -45, "yAxisTitleVisibility": "hide", "overlayFields": "$chaineddatasource_ByDayMA:result.gpsreHaltedJobsMA$", "axisY2.enabled": true, "dataValuesDisplay": "all" }, "showProgressBar": false, "showLastUpdated": false, "context": {} }

darkins

probably a basic question i have the following data 600 reason and this rex (?<MetricValue>([^\s))]+))(?<Reason>([^:|^R]+)) what i am getting is 60 in Metric Value and 0 in Reason i presume that is due to the match being up to the next NOT space, thus metric value is 60 and 0 remains in the data for Reason what is the right way to do this such that i get value = 600 and reason = reason

Posts	10
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎10-01-2024

Online Status	Offline
Date Last Visited	yesterday

Moving Average Overlay on stacked column

Stacked Bar in Dashboard Studio

TIme difference between first and last

Multiple Data Sources for one panel in Dashboard S...

Regex Help

Re: Stacked Bar in Dashboard Studio

Re: Moving Average Overlay on stacked column