Is there a way to get the Splunk Team to investigate the limitations on Trellis and why it is squishing the plots past 16 or more plots? We have hundreds of plots to analyze. Can SPLUNK Incorporated investigate any bugs or limitations to Trellis plotting? Is there a trellis configuration setting? ... View more

We basically have what we want, we just need a way for Trellis to NOT squish the plots if we desire 16 or more plots. We have nearly 150 plots to visually examine. ... View more

Yes we tried both Shared and Independent and when limit=16 or greater we get squished plots. There seems to be a scaling issue with Trellis if you try to do many plots. ... View more

This is the code for the plots. sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "B1611" "CCS" | spath Results{}.StepName | rename Results{}.Name AS StepName | spath Results{}.Actual | rename Results{}.Actual AS Actual | transaction StepName, Actual | spath Results{}.Minimum | rename Results{}.Minimum AS Minimum | eval Minimum=Minimum | spath Results{}.Maximum | rename Results{}.Maximum AS Maximum | eval Maximum=Maximum | eval output = toString(Actual) + ";" + toString(Minimum) + ";" + toString(Maximum) | makemv delim=";" output | mvexpand output | bin output span=0.25 | chart distinct_count(Minimum) AS Minimum distinct_count(Maximum) AS Maximum count over output by StepName limit=0 useother=f ... View more

Plot is till not right. I guess I need to do more research. ... View more

that code gave me three individual plots. I need Min Max and Actual to all be on the same plot. I would include a picture but I don't have enough karma points. ... View more

WOW... chart overlay very confusing example. It would be nice if the SPLUNK community could create a simple to use command called "dInclude(X,Y)" meaning data include. The meaning here is that Field X is included into field Y... so that when someone uses "chart count over Y" the data that was in X field is now part of the Y field ... like as if the Y field has adopted the X field. Now X and Y are treated as one field and all the data can be plotted together on the same X axis. ... View more

sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "B1611" "CCS" "33.[113.1] TP201 TO DGND_LF_PH" | spath Results{}.Minimum | spath Results{}.Maximum | rename Results{}.Maximum AS Maximum | rename Results{}.Minimum AS Minimum | spath Results{}.Actual | rename Results{}.Actual AS Actual | eval Actual = Round(Actual) | chart count over Actual Minimum is the lower limit & Maximum is the upper limit, they are in different fields than the Actual field. So when I use the chart command above "chart count over Actual" the upper and lower limits are not in the plot. I need to get the values of Minimum and Maximum "INCLUDED" into the bins of the actual data so that when the plot is printed on the screen I can SEE the lower and upper limits along with or included with the Actual data. ... View more

All of my plots have the same Y axis value, how can I adjust the X and Y axis dimensions so that each graphic is unique? ... View more

Thank you. This appears to work nicely. I will move forward and if I get into any trouble I'll post another question. Thanks again for the help... PS I Bought a book "Exploring SPLUNK" Primer and Cook book and it does help but does not fully explain all aspects. ... View more

I have several hundred bell curves I need to plot in trellis, but can't seem to. I can plot ONE if I call out an explicit Test name as shown in the picture. ... View more

I tried that and it gave me no bell curves, it gives me names of months of the x axis. ... View more

tried this too, still no bell curve plots in trellis, sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "CCS" "B1611" | spath Results{}.Actual | rename Results{}.Actual AS Actual | eval Actual = Round(Actual) | transaction StepName | bin Actual span=0.75 | chart values(Actual) by StepName ... View more

I tried this and the statisitcs looks better but there is no bell curve plot in trellis. sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "CCS" "B1611" | spath Results{}.Actual | rename Results{}.Actual AS Actual | eval Actual = Round(Actual) | transaction StepName | bin Actual span=0.75 | chart count(Actual) by StepName ... View more

What is the code in SPLUNK to do this? Convert PERL to SPLUNK foreach $event (@dbase){ push(@records, split(/\,/, $event)); } for($j=0; $j<$num_records, $j++){ push(@mu_set, ($records[2]+$records[3])/2); } ... View more

I don't think splunk can do what I want it to do because it appears it cannot work with data in parallel because of its pipe structure. I need to work with multiple charts and arrays in parallel and I need data structures that splunk does not have like associative arrays and indexing into those arrays... I think I should use PERL or Python to do what I need to do. I'm interested in searching of course but I need to calculate intermediate values based on search results on multiple test points TP's. I don't think splunk has that capability. ... View more

sourcetype=mfgtestengsoftware | search "Result Logged" "Results{}.Pass"=true "B1611" "Results{}.Name"="29.[111.1] TP237 TO DGND_LF_PH" | spath Results{}.Actual | rename Results{}.Actual AS Actual | spath Results{}.Maximum | rename Results{}.Maximum AS Maximum | eval Maximumx = 20 | eval Actual = Round(Actual) | bin Actual span=1 | chart stdev(Actual) as stedVal | eval capture = if(stedVal/Maximumx <= 0.17, Maximumx, Maximumx) Maximumx is not being printed out. ... View more

I'm debugging. I want to see if Maximum gets se to 20 and then I want to if it get printed out. ... View more