Gauges with dynamic ranges?

[leune]

I am trying to create a dashboard that contains gauges of which the limits are computed based on the data. Specifically, I would like one search to determine the target, and then a target-20% and a target+20% range. The actual value would then be plotted relative to those ranges.

Is it possible to create dynamic ranges for gauges?

[aljohnson_splun]

This is really old but whatever:

Its much easier to use the gauge command:

[ayme]

One way would be with a subsearch which creates the range values for you. In my example below I calculate max as the number of events from the previous timerange:

index=_internal earliest=-5m sourcetype=splunkd | stats count | gauge count [search sourcetype=splunkd index=_internal earliest=-20m latest=-10m | stats count as max | eval first=0 | eval second=10 | eval third=max/2 | eval fourth=max  | eval range=first+" "+second+" "+third+" "+fourth | return $range]

[akshaypillai]

Thanks Ayme - that worked! I was wondering how to get the Max Value populated on the visualization. any pointers for that as well?

[leune]

I tried going that route, but failed in getting the last part sorted out straight. The eval range.. and return $range is something I didn't know would work. Thanks!

[HattrickNZ]

tks very much for this, exactly what I was looking for:

And just for my reference/clarification.

I get an output like this:
x y1 y2 y3 y4
709 0 10 689.500000 1379

which comes from the seach something like:

x --> stats count | gauge count (the will be the value in the gauge)
y1 --> first (y's are the different ranges in the gauge )
y2 --> second
y3 --> third
y4 --> fourth

I presume you can have more ys?

[tfletcher_splun]

The path of least resistance is to use sideview, look up the custom module ResultsValueSetter in sideview and your life will be made easy. Your advanced xml will end up looking a bit like:

Search (to establish target and bounds) -> ResultsValueSetter (to set those values as substitutable variables) -> Search (this actually is the search to populate your gauge with the bounds dynamically inserted by the variables) -> chart (this tells the view that it needs to render your results into a chart)

[leune]

Thank you for the feedback; I haven't really dabbled with SideView, but this seems a good reason to get going on it 😉