Dashboards & Visualizations

How can i get the graph for 150 records ?

rakesh_498115
Motivator

Hi..

My search query returns me a set of 150 records and when i try to plot a graph for these 150 records , I hardly see the values for 40 records remaning were not actually plotted or shown in graph..how can i make this enable so that to see all the values coming in the graph....

Thanks in advance.

Tags (2)
0 Karma
1 Solution

jonuwz
Influencer

Ok first up you need to convert Day into a date that splunk'll understand.

| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y")

Next up, you want to plot it.

So we can add

| timechart span=1d avg(AvgBest95) as AvgBest95 avg(AvgWorst5) as AvgWorst5

You can then drill into the timeranges.

Even though we're using avg(AvgBest95) - because you have 1 pont a day (or i'm assuming you do) the average will be the same as the single value for the day anyway.

This works on splunk 4.3.x

I've you're running a previous version, you may have to resort to the xyseries method outlined here

another tip - if your dates on the x-axis look messed up even after converting to a format splunk can process adding this, fixes it a lot of the time

| makecontinuous _time

View solution in original post

0 Karma

jonuwz
Influencer

Ok first up you need to convert Day into a date that splunk'll understand.

| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y")

Next up, you want to plot it.

So we can add

| timechart span=1d avg(AvgBest95) as AvgBest95 avg(AvgWorst5) as AvgWorst5

You can then drill into the timeranges.

Even though we're using avg(AvgBest95) - because you have 1 pont a day (or i'm assuming you do) the average will be the same as the single value for the day anyway.

This works on splunk 4.3.x

I've you're running a previous version, you may have to resort to the xyseries method outlined here

another tip - if your dates on the x-axis look messed up even after converting to a format splunk can process adding this, fixes it a lot of the time

| makecontinuous _time

0 Karma

rakesh_498115
Motivator

Even now i cant see the dates...i have used like this

| inputlookup StatsData.csv | eval _time=strptime(Day,"%d-%B-%y") | fields _time,AvgBest95,Mean95,UCL95,LCL95 | makecontinous _time

Nothing Was getting displayed on X-axis .Can we have any other option for this.i am using splunk 4.3.x only...

0 Karma

rakesh_498115
Motivator

and the Day field on X-Axis ..is displaying as "..." instead of "1-JULY-12" , even that was awkard to see ..can we have a better look for this Day..ie vertically on Y-AXIS..is tat possible ? and how can we the get the graph fot all the data ??

0 Karma

rakesh_498115
Motivator

Actually i have stored my search results in a csv file..and

these results like this in order..

mydata ::

Day,AvgBest95,AvgWorst5
1-JULY-12 3.00 5.00
....

....

ie. last 3 months data..

i have used the query to retrieve these values like this..

|inputlookup StatsData.csv | fields Day,AvgBest95,AvgWorst5

i have created the line chart graph taking Day on X-Axis and AvgBest95 ,AvgWorst5 on Y-Axis..

The Graph was fine..but it was jus showing me for 1 and a half month data only..but in search results i can see all the 3 months data..i dnt knw wats happening ?

0 Karma

lguinn2
Legend

Hi Rakesh - we will need more information in order to help. Can you show us a sample of a couple of the 150 records (sanitized of course) - and your search query?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...