Hi, I don't see the min/max labels on your chart...also, I'm on Splunk 6.5 so we don't have Trellis available 😞 ... View more

Hi there, I don't understand what you mean. Can you show me where your suggestion fits in my query? ... View more

I removed that line (it was just leftover from a previous search), but I still have the same problem with my charts not displaying min/max of a column chart by the values generated with stats - (not by date). ... View more

Hey guys, I'm still stuck. I'd like the graphs to look the way they are, but have the min/max label be for each category (CPU, memory, swap) NOT the date. Right now, it's giving me the min/max for the date field only. Please help! ... View more

Oh whoops, you're right. I forgot to remove line 7 from a previous search. Just moved up the rename to line 6 so it now looks like this - thanks @DalJeanis! | stats avg(Percent_CPU_Load) AS "Avg CPU" avg(memUsedPct) as "Avg Memory" avg(swapUsedPct) AS "Avg Swap" by date ... View more

Thank you so much @niketnilay ^_^ I went with your second suggestion and the dashboard working perfectly now!! Here's the first section of XML (for token setting/switching text in search query): <input type="radio" token="field4" searchWhenChanged="true"> <label>By Hour/Weekday/Month</label> <choice value="&quot;%H&quot;">Hour</choice> <choice value="&quot;%A&quot;">Weekday</choice> <choice value="&quot;%B&quot;">Month</choice> <change> <condition value="&quot;%H&quot;"> <set token="date_label">Hour</set> <set token="sort_query"></set> </condition> <condition value="&quot;%A&quot;"> <set token="date_label">Weekday</set> <set token="sort_query">| eval sort_field = case(date=="Monday",1, date=="Tuesday",2, date=="Wednesday",3, date=="Thursday",4, date=="Friday",5, date=="Saturday",6, date=="Sunday",7)</set> </condition> <condition value="&quot;%B&quot;"> <set token="date_label">Month</set> <set token="sort_query">| eval sort_field = case(date=="January",1, date=="February",2, date=="March",3, date=="April",4, date=="May",5, date=="June",6, date=="July",7, date=="August",8, date=="September",9, date=="October",10, date=="November",11, date=="December",12)</set> </condition> </change> <default>"%A"</default> <initialValue>"%A"</initialValue> </input> Second section of XML (for graphs): <row> <panel> <chart> <title>By $date_label$</title> <search> <query>index=os (sourcetype=cpu cpu=all) OR (sourcetype=vmstat) | lookup sa_managed_servers_new.csv host | search server_group=SA machine_type=$field2$ sadb_service=$field3$ | eval Percent_CPU_Load = 100 - pctIdle | eval date=strftime(_time,$field4$) | stats avg(Percent_CPU_Load) avg(memUsedPct) avg(swapUsedPct) by date | rename avg(Percent_CPU_Load) AS "Avg CPU" avg(memUsedPct) as "Avg Memory" avg(swapUsedPct) AS "Avg Swap Memory" $sort_query$ | sort sort_field | fields - sort_field</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.text">%</option> <option name="charting.axisY.maximumNumber">100</option> <option name="charting.axisY.minimumNumber">0</option> <option name="charting.chart">line</option> <option name="charting.chart.showDataLabels">minmax</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> </chart> </panel> ... View more

Hi @niketnilay, I'd like to have the same time filter and search query, but only the time spans are different. The time selected for both searches will change depending on the filter selected. Also, I used values() because I'm looking at CPU data, and oftentimes CPU jumps from low to high within a time span, so I wanted to capture it all. That's why one of the chart is using the average and the other is using all its values. I wanted to overlay them so we can easily see all the CPU activity of a server, but also use the average line chart to see any overall trends. Hi @gpradeepkumarreddy I believe chart overlay doesn't work if the charts are using different time spans (at least I have not gotten it to work with different spans). Thanks! ... View more

Thanks! So the reason why the first image returns 5 results is because there are actually 5 other rows of data (for 5 different hosts/servers) which I didn't capture in the screenshot. It doesn't reflect the data that goes into creating the sparkline, it is only the result of all the hosts/servers from my query: stats sparkline(avg(Percent_CPU_Load)) as Activity avg(Percent_CPU_Load) as Average, max(Percent_CPU_Load) as Peak, min(Percent_CPU_Load) as Low, avg(pctIowait) as WaitTime by host That is why I believe the problem is in this part of the query: | search CPUbucket="Greater than 95%" CPU=all However, I need that part of the query because I want to search for ALL hosts/servers that have CPU Greater than 95%, so I need that search option in there. However, I also need the sparkline to show the individual trend of a specific host/server and somehow it's not portraying it accurately. ... View more

Yes!! The following works like a charm, thank you @niketnilay. I should have been using charting.fieldColors instead of charting.seriesColors . Here is my code: {"Critical":D16367,"Major":F0B67F,"Minor":F3DE8A,"Notice":C9C5CB,"Healthy":CAE7B9} ... View more

Thank you @niketnilay and @mayurr98! Unfortunately, I'm still on Splunk 6.5.3 and Trellis is not available to me 😞 but I did try rotating and adjusting the height and it works, but since the text doesn't wrap it's still very long and not practical to display it in that way. ... View more

Thank you @niketnilay and @mayurr98! Unfortunately, I'm still on Splunk 6.5.3 and Trellis is not available to me 😞 but I did try rotating and adjusting the height and it works, but since the text doesn't wrap it's still very long and not practical to display it in that way. ... View more

I downvoted this post because link no longer works ... View more

Hi, I'm also having a similar problem. I'm trying to compare count from the past 7 days vs. count from the past 7 days (7 days ago). However, when I look at the totals and compare it with the per day count, it doesn't add up. ... View more